HTTP/2-based DoS attacks are here to stay. Many implementations are hardened to them. Quirky behaviour can trigger defenses and cause ENHANCE_YOUR_CALM. Read one of my latest trips down a debugging rabbit hole. blog.cloudflare.com/go-and-enhan...

Glad to announce that my team at @cloudflare.social released a 1.0.0 version of a cross-browser web performance testing agent that supports Chrome, Firefox, Safari and Edge. Thank you to @tkadlec.bsky.social for making it happen and writing most of the code so far! github.com/cloudflare/t...

About 6 months ago Louis Navarre reached out to report some DoS-related vulnerabilities in quiche's ack processing. We fixed it up and saw no evidence that the vulnerabilities had been exploited. Check out the deep dive blog post: blog.cloudflare.com/defending-qu...

Some news.. blog.cloudflare.com/moq/

It would be funny it wasn't actually true

Hehe

Watching Usyk vs. Dubois squashed into a sports bar booth in Porto with 4 randoms, 2 from London, 2 from Ukraine, was not on the bingo card. But it all worked out.

I can predict how these new age checks are going to go using two pictures

I've heard of crackpot science. I guess the future equivalent is grokbot science

I'm excited to announce I'll be at gRPC Conf on August 26 2025 to present how Cloudflare built its gRPC support first launched in 2020, and how we've been adding gRPC over HTTP/3 support lately. Session details at: grpcconf2025.sched.com/event/26BMY/...

Hot off the press, happy to announce the adoption and publication of datatracker.ietf.org/doc/html/dra... Unencoded Digest is one of the missing pieces for certain use cases like the W3C signature-based integrity work. Helping to cover cases where encoding and transform independence are paramount

An IRTF Retrospective – in which I reflect upon my time as Chair of the IRTF csperkins.org/standards/20...

Wouldn't call it vibe coding but I've been using some AI to add features to throwaway test toys written in Go to Get Shit Done. Look out for some future updates about the $thing these toys are helping to make robust.

Using Internet standards to improve the the way automed traffic / bots can interact with the world. Namely two methods: HTTP Signatures (RFC 9421) and req mTLS flag (draft-jhoyla-req-mtls-flag) blog.cloudflare.com/web-bot-auth/

Enjoying Kagi quite a bit

AI slop has gotta stop. Hysterical* thing with this bullshit report to curl's hackerone (hackerone.com/reports/3125...) "HTTP/3 Stream Dependency Cycle Exploit" is we took great pains to standardize a priortization scheme that entirely did away with stream dependencies. * not the jovial definition

My team at Cloudflare are hiring mid-level and senior engineers to help us go deep on network protocols (HTTP, QUIC, TLS etc.) as we build and deploy our new Rust-based proxy. More details (including location) over on LinkedIn: www.linkedin.com/posts/lucasp...

Check out this cool shit

Gearing up to chair the next QUIC WG meeting be like

Multipath Extension for QUIC is now in Working Group Last Call. datatracker.ietf.org/doc/draft-ie...

Welcome back, now fix my stuff plz

Tomorrow's presentation to the HTTP WG is going to be a hoot

Discovered a pinball gem on my local town www.pinballrepublic.com

All logs lead to qlog

I ordered 2 of these, look amazing.

Second patent cube has arrived, so I guess it can formally be called a collection.

Broadcast IP never fails to amaze

On January 23, 2025, Cloudflare was notified via its Bug Bounty Program of a vulnerability in Cloudflare’s Mutual TLS (mTLS) implementation. Read the blog post for details of the vulnerability and how my colleagues put in place mitigations in short order. blog.cloudflare.com/resolving-a-...

Finally cracked some wasm stuff that has been on the bottom of the todo list for a while

h3i is a command line tool and Rust library designed for low-level testing and debugging of HTTP/3, which runs over QUIC. We've replaced our hodgepodge of test tools with it and caught server bugs in the process. Deep Dive at blog.cloudflare.com/h3i

Annual Picard youtu.be/oiSn2JuDQSc?...

I got something in the pipeline for ya

That feeling when you spent weeks of people time investigating a problem, then find an open bug from ~10 years ago that sounds eerily the same: issues.chromium.org/issues/41161...

This year, I again had the honour of authoring the HTTP chapter of the Web Almanac: almanac.httparchive.org/en/2024/http It's full of interesting stats on technologies like HTTP/3, DNS HTTPS records, preloads, 103 Early Hints and the FetchPriority API. It also has Pirates 🏴‍☠️ and Marry Poppins 🌂!

I am once again writing parsing code for Chrome netlogs. The format for QUIC transport parameters is some funky ass string.

Think subresource integrity is good in theory but sucks in practice because the hashes change too frequently? New approach here that removes some if the pains

Step 1

At the same time Disney+ told me the price of renewal would close to double and I decided to cancel it completely. YouTube offered me a free 2 month trial or premium. I'm feeling weirdly conflicted that I actually seem to enjoy YouTube more now and might continue it on..

www.rockpapershotgun.com/recent-chang... So it turns out for the last couple of weeks, Firefox's tracking protection had completely hidden the RPS new comment system. And there I was thinking they'd just turned comments off altogether.

First draft is out Fiddler - Mistakes and Happy Accidents textslashplain.com/2024/11/24/f...

I can't believe its not butter suno.com/song/a815d6d...

Ladies and gentlemen. I present to you. HTTP number 5. youtube.com/shorts/xqTRK...

Took 2 mins at #PerfNow to talk about the RUM Community Group in W3C for anyone doing RUM. It's free and easy to join if you're interested! www.w3.org/community/ru...

Imagine a world with a common stream multiplexing capability, usable over any reliable ordered substrate (TCP, QUIC, Unix sockets, etc), and decoupled from any specific application layer. Interested? See my slides from this year's HTTP Workshop at github.com/HTTPWorkshop...

From the dew-soaked hedge creeps a crawly caterpillar When the dawn begins to crack It's all part of my autumn almanac

Feels like this is some motivational poster about shifting goalposts

IETF 121 here we go. For the next 7 days, QUIC must be pronounced craic.

CTRL-A, CTRL-C Windows dialogs --------------------------- Setup --------------------------- Setup has detected that Setup is currently running. Please close all instances of it now, then click OK to continue, or Cancel to exit. --------------------------- OK Cancel ---------------------------

I'm building a web perf starter pack but I'm still looking for folks to add - please let me know who I'm missing because I haven't found them all on bsky yet go.bsky.app/RVWSVqe