Protocols, security incidents, and how the internet actually works. 147 posts.
The Slowloris attack is from 2009. It fits in one small script, needs one machine and no bandwidth, and will still stall a thread-per-connection server left without request timeouts. It wins by going slow — and the fix is the same one HTTP/2's record-breaking floods needed.
In April 2024 a researcher showed a single TCP connection could crash Apache, Node.js, and Tomcat with HTTP/2 frames that never appear in an access log. The bug was everywhere at once — because it lived in the spec's seams, not the code.
Server Push was HTTP/2's marquee feature: send files before the browser asks. Chrome ripped it out in 2022 after finding it used on 0.7% of sites and often making things slower. What replaced it did the opposite thing, and that's why it worked.
In August 2023 Google, Cloudflare, and AWS all logged record DDoS attacks, and Cloudflare's came from a botnet of only about 20,000 machines. The weapon wasn't bandwidth. It was an HTTP/2 feature working exactly as designed.
The difference between 301 and 302 isn't 'permanent vs temporary.' It's two unrelated decisions the codes quietly bundle together — and a 301 you set by accident can live in a stranger's browser cache forever.
Adding your domain to the HSTS preload list is a one-way door. The list lives inside the browser binary, not on your servers, so undoing it means waiting months for a Chrome release you don't control — and that's the part nobody mentions when they tell you to preload.
Most deployed CSPs do nothing. Google measured it: 94.7% of script-limiting policies are bypassable. The syntax is easy. The header is hard for a different reason.
QUIC is reliable, ordered, congestion-controlled, and encrypted — everything UDP refuses to be. So why build it on UDP? Because UDP was the only new-protocol-shaped hole left in the internet's plumbing.
You can type any browser you like into your User-Agent string. It's the one field nobody trusts — because everything underneath it, the TLS handshake and the HTTP/2 settings, was written by your libraries, not by you.
CDN cache poisoning tricks a CDN into caching a malicious response and serving it to all subsequent visitors. One weird request, a lot of collateral.
Not all security headers are equal. Some prevent real attacks daily. Some are legacy relics browsers ignore. Here's an honest priority list.
The gap between easy headers and hard headers is enormous. Most sites set X-Content-Type-Options and skip Content-Security-Policy. The data shows exactly how wide the gap is.