HN

Comments (62)

• Menu

  Twey
  This would have been flagged by Clippy lints `let_underscore_untyped` or `let_underscore_must_use`, which sadly are not enabled by default.
• Menu

  edelbitter
  Cloudflare does not notice (until a customer complains) that they are sending broken responses at scale? I would have thought they would notice this from sampling and linting a few replies.. just in case they did something like Cloudbleed again.
• worldsavior
  > We spent six weeks chasing a nearly invisible bug — a race condition that occurred only under specific conditions — in the hyper library that impacted how the Images binding returned processed image data back to the client. In the end, it took four lines of code to fix it.That's a long time, must be frustrating.
• Menu

  microgpt
  Would using Rust have prevented this?
• Menu

  pseudony
  So “fearless concurrency” still only happens when one just decides to not be afraid… :)
• nopurpose
  Nice writeup, but I don't understand how `curl` didn't trigger bug for them (or any other hyper HTTP server out there), given the explanation in the article.`curl --http1.1` sends `Connection: Close` so sender (hyper) must attempt to shutdown connection after sending whole body. Surely any network is slower than memory copy into socket kernel buffers, so it must reliably trigger condition "buffer flush can't be done in one go" and thus trigger early TCP shutdown.
• anon
  undefined
• Menu

  100ms
  > The failure was caused by a timing-dependent race condition in hyper’s HTTP/1 connection handling. When the reader was slower and the socket buffer filled, poll_flush returned Poll::Pending, but the dispatch loop discarded that result. Hyper then treated the response as complete and shut down the socket while data remained buffered internally, causing the client to receive an EOF before the full body arrived.https://github.com/hyperium/hyper/issues/4022Saved you 3000 words
• anon
  undefined
• nopurpose
  [dead]
• Menu

  logicchains
  [flagged]
• Menu

  giammbo
  [flagged]
• Menu

  Thaxll
  So much for Rust forcing you to handle errors.
• Menu

  algoth1
  I wonder if this bug was found via project glasswing
• xacky
  Yet Cloudflare relies on bugs in browsers to "verify" you.