Re: [quicwg/base-drafts] How to reject a connection attempt (#3690)

[Martin Thomson <[e-mail]>]

I think that @kazuho is entirely right here.  The renaming of the error code is useful as it removes the *implication* of a semantic that would be destructive.  That implication is that the code is like a 503, which comes with the *further* implication that holding back for some time is desirable (due to the common use of Retry-After with 503).  QUIC has no Retry-After, so any implied time delay is bogus.

As mentioned, that browsers might sit and wait is a policy decision that makes sense in the current state of the world.

I'm going to merge the PR.  But I get the sense that this is not directly addressing the issue.  For the issue itself, I think that the only real resolution is: that's tough, but too bad.  As numerous people have said, this phase of connection establishment is ripe for DoS and we have chosen to accept that risk in QUIC version 1.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3690#issuecomment-634332765