8

Myself and several other colleagues have had multiple occasions over the last few weeks where we found Stack Overflow to be unavailable from our work computers. Once this happens, it remains the case for some time - I don't have an exact time, but the it's on the scale of several minutes but not hours. I found that disconnecting my VPN made it available again when I was working from home (we have experienced it both over VPN and from the office).

When it is down, the browser just says "The connection was reset". Usually it's only been Stack Overflow - at least when I tried Server Fault was still available.

A curl command during the time it is unavailable showed the TLS handshake failing

$ curl -vvv https://stackoverflow.com/questions/69725545/how-to-fix-javadoc-comment-has-parse-error-details-no-viable-alternative-at-in
* Trying 151.101.1.69:443...
* Connected to stackoverflow.com (151.101.1.69) port 443 (#0)
* schannel: disabled automatic use of client certificate
* schannel: ALPN, offering http/1.1
* schannel: failed to receive handshake, SSL/TLS connection failed
* Closing connection 0
curl: (35) schannel: failed to receive handshake, SSL/TLS connection failed

My IT department investigated and it looked like the culprit might be the fact that the firewall was blocking QUIC. They are investigating further. However, the next time it happened I disabled QUIC in Chrome and it started working from there - although the curl command still failed in the same way.

The thing is, the firewall always blocks QUIC - so why does it work most of the time? I wondered if you (or any hosting partner) were doing any A/B testing or similar that might mean QUIC was sometimes offered and sometimes not?

It has been pointed out that curl without the --http3 option does not use QUIC, which does challenge my analysis. We continue testing. I should maybe have mentioned that my curl was run from a windows machine (using cygwin - but the curl command is the windows one). Version reports

$ curl --version
curl 7.79.1 (Windows) libcurl/7.79.1 Schannel
Release-Date: 2021-09-22
Protocols: dict file ftp ftps http https imap imaps pop3 pop3s smtp smtps telnet tftp
Features: AsynchDNS HSTS IPv6 Kerberos Largefile NTLM SPNEGO SSL SSPI UnixSockets
4
  • 2
    curl without the --http3 option does not use QUIC. Mar 9 at 11:39
  • Might also be related to the recent DDoS attacks. Mar 11 at 5:41
  • Also, if you were to test in a network monitored environment, you would know it very easily whether it is due to QUIC or due to usual TLS over TCP. Especially ALPN, offering http/1.1 seems like it is not using QUIC. Mar 11 at 5:43
  • I will report to this question if I find any details myself. I haven't seen any issues myself yet. Mar 11 at 13:51

0

You must log in to answer this question.

Browse other questions tagged .