Hacker News Reader

No, but QUIC definitely falls in the overly complicated category, spanning multiple, large RFCs.

This attack is just about failing to enforce the negotiated parameters during the start phase of the connection.

Wait till you see the TCP RFCs…

I guess it helps that TCP is usually covered to some extent in an undergrad course, and also that it's unencrypted.

I don't think this has too much to do with the spec and more about discovering and preventing DoS vectors.

Also HAProxy managed to predict and mitigate this issue 5 years ago.

Sounds like the OAuth2 spec.

Well have you seen oauth1? So much trouble to be able to support non-secure HTTP.

I'm on a project where OAuth 2.0 will be implemented. Please send help.