patrickmcmanus

5 ms·

1.
by patrickmcmanus 5y ago
The IETF WG DBOUND tried to find a better solution to this problem and did not reach any consensus. fwiw. https://datatracker.ietf.org/wg/dbound/about/ The current way most of this is handled is via a list pu
2.
How Compute Edge is tackling the most frustrating aspects of serverless(fastly.com)
2 points by patrickmcmanus 6y ago|0 comments
3.
Bytecode Alliance: One year update(bytecodealliance.org)
51 points by patrickmcmanus 6y ago|8 comments
4.
by patrickmcmanus 6y ago
a 1 yen coin has a mass of 1 gram - which can be handy for measuring stuff.
5.
by patrickmcmanus 6y ago
absolutely! and some eTLDs are preloaded (like .dev) already and that of course applies to the domains registered in them - which is a nice property.
6.
by patrickmcmanus 6y ago
you're thinking of an exploit in spdy (the h2 predecessor) in which the headers were just run through the same gzip context. The HPACK format in h2 and h3 is meant to remove those oracles. (though it is less effective bytewise than gzi
7.
by patrickmcmanus 6y ago
protecting against the zero-bound is the value - that's not a scam. As the ratio of potential loss to net worth drops, that's less interesting and so is the insurance. Varying levels of deductible choices hard code this notion eve
8.
by patrickmcmanus 6y ago
I think we'll see some DNS version of alt-svc that doesn't require TCP to bootstrap.. see httpssvc and svcb
9.
by patrickmcmanus 6y ago
websockets is carried on TCP. Often bootrstapped on HTTPS tcp/443.
10.
by patrickmcmanus 6y ago
preamble of chunk length and 1 bit for end-of-message indicator.. if you only do chunk length you will eventually find you can't stream but want to. or just use http.
11.
How and WHY I'm teaching my kids about my job as part of their homeschooling(annacrowleyredding.com)
1 points by patrickmcmanus 6y ago|0 comments
12.
by patrickmcmanus 6y ago
the author is writing, in that section, about blind (i.e. off path) attacks. Given the attacker in that model is off-path they don't see the challenge ack.
13.
by patrickmcmanus 6y ago
QUIC is considerably more resilient than TCP to RST attacks because it authenticates the transport itself once the handshake is complete.
14.
HTTP/3 and QUIC aim to help the connections that need it most(fastly.com)
2 points by patrickmcmanus 6y ago|0 comments
15.
Three ways TLS 1.3 protects origin names(fastly.com)
1 points by patrickmcmanus 7y ago|0 comments
16.
Supercharging Server Timing with HTTP Trailers(fastly.com)
1 points by patrickmcmanus 7y ago|0 comments
17.
by patrickmcmanus 7y ago
The way I look at it a lot of what we logically think of as the network layer often exists in userspace anyhow. That's the point of DPDK/snabb/netmap and other kinds of driver bypass. The important design distinction about th
18.
by patrickmcmanus 7y ago
tl;dr; congestion control is basically pluggable. Much like in TCP, congestion control really isnt something required for interoperation between peers. Given the userspace nature of QUIC I would expect to see a lot of iteration on this fron
19.
by patrickmcmanus 7y ago
These are essentially seperable features - and given that QUIC is at a later stage than ESNI there is not a compelling reason to create a blocker to getting an open QUIC standardized. QUIC uses the TLS 1.3 client hello (and its extension me
20.
by patrickmcmanus 8y ago
corollary question - if DNS data is not authenticated then how does the client distinguish between police and attackers? much better to authenticate the policer.
21.
by patrickmcmanus 8y ago
as they say - there are many reasons a company can succeed, but they all fail for the same reason. (they run out of money). So cash is king - follow the signs of cash flow. #1 - watch the sales staff. Their comp is a direct reflection of th
22.
by patrickmcmanus 8y ago
the post is good.. but also: confidentiality matters. Think about a library. There are no secrets in the stacks that need to be kept from public disclosure. What is secret is the act of using the library - i.e. what they choose to read.
23.
by patrickmcmanus 8y ago
That was one of my favorite Mozilla Open Source Support projects!
24.
by patrickmcmanus 8y ago
restricted to: "solely to improve the performance of Cloudflare Resolver for Firefox and to assist us in debugging efforts if an issue arises"
25.
by patrickmcmanus 8y ago
The counterpoint is that traditional DNS has horrendous loss recovery and basically no congestion control and these things definitely benefit DoH at the tail. QUIC will let us have it both ways (and as QUIC has an HTTP definition, its basic
26.
by patrickmcmanus 8y ago
cdn switchers/sharers are very interesting here. e.g. cedexis
27.
by patrickmcmanus 8y ago
The most important attribute of DoH is, imo, authentication with the resolver. The browser has a terrible time with 3rd parties messing with the DNS stream. DoH allows the browser to be sure its using the resolver (and therefore the resolve
28.
by patrickmcmanus 8y ago
wrt esni the anonymity pool is definitely the set of content that can share the same address pool. In a world with lots of CDNS (and several multi-CDN switching services) this covers a huge amount of content - but I agree - not everything.
29.
by patrickmcmanus 8y ago
right - but we're coming for cleartext sni too: https://tools.ietf.org/html/draft-rescorla-tls-esni-00 interestingly, something like DoH is a pre-requisite for pulling off esni.
30.
by patrickmcmanus 8y ago
The expected common deployment mode is soft fallback - using traditional DNS if connections cannot be made via the DoH resolved address. Captive portal provides the most common use case. There is a hard failure mode available that you can u

More ›