> The exemption only applies to businesses that specifically only make bread and nothing else. Even bagels disqualify the exemption
This is not accurate. The exemption applies to businesses that sell bread starting before September 2023. The exemption excludes restaurants that sell bagels and/or croissants but who don't sell bread.
The new technique described avoids the maximum limit on number of requests per second (per client) the attacker can get the server to process. By sending both requests and stream resets within the same single connection, the attacker can send more requests per connection/client than used to be possible, so it is perhaps cheaper as an attack and/or more difficult to stop
This is not accurate. The exemption applies to businesses that sell bread starting before September 2023. The exemption excludes restaurants that sell bagels and/or croissants but who don't sell bread.
https://www.nationalreview.com/corner/pay-a-higher-minimum-w...