Subject: h2#416: Limit stream count

From: Martin Thomson <[email-masked]>
Date: Tue, 25 Feb 2014 16:37:42 -0800

https://github.com/http2/http2-spec/issues/416

Roberto, as the former strongest advocate for the current unlimited
initial value, does this extend to a limit on the stream count?  Or is
it just a recommendation that we make in security considerations?

Either way, I think that it's an easy thing to do.

It reduces the number of guesses that can be made against HPACK.  I'm
not sure if it goes far enough to address #373.  Absent some
revelation, I'm of the mind that any shared context (browsers,
proxies) will have to restrict how items in the header table can be
accessed if we intend to keep HPACK.

---

From: Roberto Peon <[email-masked]>
Date: Tue, 25 Feb 2014 16:44:29 -0800

It implies that a security-conscious entity will want to keep the limit at
some moderately large, but finite value, e.g. 1000.

-=R

---

From: Martin Thomson <[email-masked]>
Date: Thu, 27 Feb 2014 10:41:52 -0800

> some moderately large, but finite value, e.g. 1000.

Thinking about this a little more, this is not an opportunity the
server has when a connection is first established.  A network attacker
should have no trouble forcing a client to create a new connection for
each attack.  That means that the guidance isn't that you limit your
own settings, but that you maintain a limit of your own.