Post

When @jameskettle.com dropped his last-byte synchronization research back in 2019 I started hunting for race conditions. It's crazy that this still works so often 7 years later. It's such a common, widespread issue and I don't think most hackers are checking for it (usually low dupe count)

In 2023, @jameskettle.com also figured out a way to squeeze multiple HTTP requests into a single TCP packet so that they all arrive without delay between them.