HTTP/3

There's a speed change, which is something called Happy Eyeballs version three that should make browsing go a little quicker.

Simply, every time Firefox loads a page, it has to pick a path to reach a server, maybe over IPv4, IPv6, maybe HTTP2 or the newer HTTP3.

The older Firefox versions picked one path and waited to see how it worked before trying another.

If that first go was slow or broken, the page just sat there.

There's nothing to configure.

You'll just notice fewer pages hanging while loading.

worth noting though is it's still in ietf draft and it's not a finished standard and mozilla says it's only active on some platforms so far though they didn't specifically name the platform so i can't say for a hundred percent certain that it's that it's working on linux but it's definitely coming if it's not Another speed upgrade is QUIC, Q-U-I-C, version two support for HTTP3.

QUIC is the connection tech behind a lot of modern webpage loading speeds.

First is a thing called Happy Eyeballs V3.

This is a little system that tries all possible connection methods to a website, HTTP2 or HTTP3, at the same time.

And they use whatever gets an answer first, dropping the slower connection in the process, instead of trying those sequentially and then going with the fastest.

Because this means you would lose out some loading time if the one you started first is not the fastest one.

It might not be on every platform yet, Mozilla did not say which platforms didn't support it at the time I'm recording this, so maybe it's not on Linux yet, maybe it's not on mobile phones yet, but this is an interesting one.

And second, they're also now using a newer version of QUIC.

which is a protocol used for HTTP3 connections instead of TCP.

A QUIC apparently is faster at establishing and resolving requests.

But I've been doing this stuff since the 70s.

Yeah, it's an HTTP3 thing, so it came out in that time frame.

I'd have to look that up, what the date on that was, but it's part and parcel of HTTP3.

And Zero Perhaps says, what protocol does USB use? Is TCP involved, or is there robust error correction or retransmissions?

No, the cables are so short that I think it's like...

And we did a patch of Planet Week with them.

And we had a really good high severity finding in, I think it was like HTTP3.

And it turns out that that finding also applied to the mainline NGINX.

And I think that's been like the juiciest finding so far.

I'm happy to clarify.

MASK is this protocol that runs over HTTP3.

And so the traffic looks like normal HTTP traffic.

It doesn't look like it's WireGuard traffic or some undistinguishable traffic.

Right.

And so the best ways, let's say, to get around this sort of regime is to make your traffic look like good traffic as much as possible, which is exactly what Mask does.

It makes the VPN traffic look exactly like normal HTTP3 traffic.

And I thought those were so ingenious.

But now the cars are being used as exit points for criminal activity, just like smart TVs have been used and home routers have been used for several years in similar botnets.

There's a tsunami attack, which exploits HTTP3.

HTTP3 has some kind of sophisticated header information where you can define an object and then refer to it with a short handle.

But in a content delivery network like Cloudflare, it then has to pass that on to a server, which usually does not speak HTTP3.

So if it converts the HTTP3 down to HTTP1, it needs to expand all the headers to their full size, and that can lead to a huge amplification of a denial-of-service attack, under some cases 350 times more traffic than what came in.

So this affects six major content delivery networks, Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent.

So now they've been alerted to it, and presumably they will try and patch it.

And for me, it's almost always, I usually do backend stuff and usually some things like web and internet-based.

So I won't be talking about like embedded systems in this context, but it's usually like a bunch of small REST services with some front end, probably with something like an HTTP3 or WebSocket connection so you can do something real time.

And there's a path for doing CRUD that's just synchronous.

And then there's a path for mutations to flow through the system and allow their effects to ripple.

But that friction is exactly what we are unpacking today.

We're looking at a stack of protocol research, architectural overviews to really understand QUIC and HTTP3.

Right.

Because these are the invisible brilliant upgrades that are fundamentally rewiring the Internet to be faster, more resilient and just perfectly suited for how we actually live.