# It's believed that SPDY is a huge DDoS vector by itself **URL:** \ **Category:** NGINX\ **Created:** [January 28, 2014, 1:34pm UTC](https://www.ruby-forum.com/t/its-believed-that-spdy-is-a-huge-ddos-vector-by-itself/238775 "2014-01-28T13:34:48Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![musicdenotation](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea666f/32.png) [@musicdenotation](https://www.ruby-forum.com/u/musicdenotation)\ **Post date:** [January 28, 2014, 1:34pm UTC](https://www.ruby-forum.com/t/its-believed-that-spdy-is-a-huge-ddos-vector-by-itself/238775/1 "2014-01-28T13:34:48Z")
The subject is a quote of Maxim D. in a discussion found here: > **[Re: \[PATCH\] SPDY/3.1 protocol implementation](https://forum.nginx.org/read.php?29,246885,246902#msg-246902)** > > http://nginx.org/patches/patch.spdy-v31.txt This patch upgrades implementation of SPDY protocol in the ngx\_http\_spdy\_module from draft 2 to draft 3.1. I am going to commit it at the end of this week. Till then, testing, review and suggestions are... It would be nice to have a detailed list of SPDY functionality that could be used as a DDoS vector. And it would be even better, to have an nginx configuration example to workaround each problem without simply disabling features. Last, should there be a default configuration in nginx/spdy which prevents the abuse for DDoS attacks? Any thoughts? Thanks. Posted at Nginx Forum: > **[It's believed that SPDY is a huge DDoS vector by itself](https://forum.nginx.org/read.php?2,246911,246911#msg-246911)** > > The subject is a quote of Maxim Dounin in a discussion found here: http://forum.nginx.org/read.php?29,246885,246902#msg-246902 It would be nice to have a detailed list of SPDY functionality that could be used as a DDoS vector. And it would be even... ---
**Author:** ![JackB](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/65b543/32.png) [@JackB](https://www.ruby-forum.com/u/JackB)\ **Post date:** [January 28, 2014, 10:00pm UTC](https://www.ruby-forum.com/t/its-believed-that-spdy-is-a-huge-ddos-vector-by-itself/238775/2 "2014-01-28T22:00:41Z")
I would like to second this. ---
**Author:** ![JackB](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/65b543/32.png) [@JackB](https://www.ruby-forum.com/u/JackB)\ **Post date:** [January 29, 2014, 1:32am UTC](https://www.ruby-forum.com/t/its-believed-that-spdy-is-a-huge-ddos-vector-by-itself/238775/3 "2014-01-29T01:32:04Z")
I think what you both request is interesting. However, I would like to push the analysis further. Is seems SPDY design is flawed because it enables flexibility and offer new features compared to HTTP without taking into account the very basis of a protocol: being efficient by allowing quick and inexpensive routing of its packets. Some other projects drafted towards HTTP/2.0 are made with efficiency in mind. One of them is called _HTTPbis_ and has been first drated mid-2012 by 4 interesting guys: Willy Tarreau (HAProxy), Poul‐Henning Kamp (Varnish), Adrien de Croy (WinGate) and Amos Jeffries (Squid). Look at that: 1 load-balancing guy, 1 cache one and 2 proxy ones… Those guys definitely want to avoid leveraging (D)Dos attacks! They coopareta with other teams (SPDY one being one of them), but I like the approach they took at the very beginning. ## Is the nginx team aware of that project? Does it seems interesting enough so nginx could support it in the near future? Or do you have any plans around HTTPbis? _B. R._ ---
**Author:** ![JackB](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/65b543/32.png) [@JackB](https://www.ruby-forum.com/u/JackB)\ **Post date:** [January 29, 2014, 1:54am UTC](https://www.ruby-forum.com/t/its-believed-that-spdy-is-a-huge-ddos-vector-by-itself/238775/4 "2014-01-29T01:54:56Z")
OK, thanks for your lights on this. They chose to work with SPDY, right, but are their ideas being followed-up to SPDY? Or will their protocol stay on a parallel path? The problem would then be that SPDY is backed by a major networking actor which name start with a G… ## SPDY simply can’t be the best protocol without being ‘Network-friendly’ (and could even be dangerous as a dormant bomb is). _B. R._ ---
**Author:** ![JackB](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/65b543/32.png) [@JackB](https://www.ruby-forum.com/u/JackB)\ **Post date:** [January 29, 2014, 1:47am UTC](https://www.ruby-forum.com/t/its-believed-that-spdy-is-a-huge-ddos-vector-by-itself/238775/5 "2014-01-29T01:47:19Z")
Hey, > Some other projects drafted towards HTTP/2.0 are made with efficiency in > mind. > One of them is called HTTPbis and has been first drated mid-2012 by 4 > interesting guys: Willy Tarreau (HAProxy), Poul‐Henning Kamp (Varnish), > Adrien de Croy (WinGate) and Amos Jeffries (Squid). > Look at that: 1 load-balancing guy, 1 cache one and 2 proxy ones… Those > guys definitely want to avoid leveraging (D)Dos attacks! HTTPbis isn’t a protocol, it’s the name of an IETF working group responsible developing and maintaining HTTP. What you’re referring to is called “Network-Friendly HTTP Upgrade”: > **[Proposal for a Network-Friendly HTTP Upgrade](https://datatracker.ietf.org/doc/html/draft-tarreau-httpbis-network-friendly-00)** > > This document proposes an upgrade to HTTP messaging which aims at being faster, more robust and more friendly to mobile networks than the current version, while retaining the same semantics and offering a high enough compatibility level to make it... But HTTPbis chose SPDY as a base for HTTP/2.0, so there is no point in adding support for all the proposed alternatives (even if they are indeed better). Best regards, Piotr S.