Hacker News Reader

If you want lots of details, this specific post on the mailing list is there https://www.mail-archive.com/haproxy@formilux.org/msg44136.h...

haproxy mitigated this attack in 2018 as an implementation bug:

https://news.ycombinator.com/item?id=37833365

That would have been wonderful context for them to include.

Whoa. So they're 5 years ahead of everyone else?

> After rigorous testing, we have been able to confirm that our implementation of the HTTP/2 protocol can handle the Rapid Reset Attack without increasing the resource usage or compromising the parallelism of the protocol.

You are free to conduct your own tests? AFAIK the software in question is free (both libre and commercially).

> make anyone else think they just failed to properly test/verify their claim?

Nope, not me.