4 ms·

Is there any work being done on being able to easily switch out standards? That way when https is found to lack some feature, we can easily upgrade to httpz al

Is there any work being done on being able to easily switch out standards? That way when https is found to lack some feature, we can easily upgrade to httpz almost immediately?

p4lindromica 10y ago
The s in https just means secure. It has evolved from SSL to TLS with various versions of each. The http in https just means http. It has evolved from http/1.0 to http/1.1 to http/2. I'm not sure what you're asking or how it is relevant to Let's Encrypt.
sp332 10y ago
The situation is not ideal. But the consensus among browser makers is that the previously-relevant standards bodies move too slowly. They can implement new transport features independently (like Chrome did with SPDY and QUIC). But the downside is that fragmentation is more likely, as most browsers implemented SPDY's features in HTTP/2 but only Opera has added QUIC.
vtlynch 10y ago
This will likely never be the case due to how HTTPS actually works. As someone else stated, HTTPs is HTTP + TLS. The "s" in HTTPS is for "secure", and TLS provides that security. TLS is a evolving standard which is updated over time to add new features when necessary. When HTTPS is negotiated, it can seamlessly choose which version of TLS to use, based off what the client and server want to use. So, HTTPS will never die due to lack of features. A new version of TLS will just be approved and deployed, and newer devices can use that while older devices can get by on an older version of TLS. TLS is the successor to SSL. They are backwards compatible, so devices that support TLS also support SSL. The full version history, from newest to oldest, is: TLS 1.2, TLS 1.1, TLS 1.0, SSL 3, SSL 2. In reality, very few servers still use SSL 3 or SSL 2, due to known weaknesses, but colloquially, all the versions are just called "SSL". TLS 1.3 is underway and will shortly be ready for primetime. Firefox and Cloudflare have already written some implementations based on the draft spec (sorta how routers will implemented the newest 802.11 standards before they are 100% official).
- profmonocle 10y ago
  Plus, even if we did decide to fully replace TLS, nothing would necessarily need to happen with certificates. We call them "SSL certificates", but the certificate standard - X.509 - actually predates SSLv1 by several years. A TLS alternative/replacement could adopt the X.509 standard as its certificate format and automatically work with the existing CA system.

Is there any work being done on being able to easily switch out standards? That way when https is found to lack some feature, we can easily upgrade to httpz almost immediately?

p4lindromica 10y ago

The s in https just means secure. It has evolved from SSL to TLS with various versions of each. The http in https just means http. It has evolved from http/1.0 to http/1.1 to http/2. I'm not sure what you're asking or how it is relevant to Let's Encrypt.

sp332 10y ago

The situation is not ideal. But the consensus among browser makers is that the previously-relevant standards bodies move too slowly. They can implement new transport features independently (like Chrome did with SPDY and QUIC). But the downside is that fragmentation is more likely, as most browsers implemented SPDY's features in HTTP/2 but only Opera has added QUIC.

vtlynch 10y ago

This will likely never be the case due to how HTTPS actually works. As someone else stated, HTTPs is HTTP + TLS. The "s" in HTTPS is for "secure", and TLS provides that security. TLS is a evolving standard which is updated over time to add new features when necessary. When HTTPS is negotiated, it can seamlessly choose which version of TLS to use, based off what the client and server want to use. So, HTTPS will never die due to lack of features. A new version of TLS will just be approved and deployed, and newer devices can use that while older devices can get by on an older version of TLS. TLS is the successor to SSL. They are backwards compatible, so devices that support TLS also support SSL. The full version history, from newest to oldest, is: TLS 1.2, TLS 1.1, TLS 1.0, SSL 3, SSL 2. In reality, very few servers still use SSL 3 or SSL 2, due to known weaknesses, but colloquially, all the versions are just called "SSL". TLS 1.3 is underway and will shortly be ready for primetime. Firefox and Cloudflare have already written some implementations based on the draft spec (sorta how routers will implemented the newest 802.11 standards before they are 100% official).

profmonocle 10y ago
Plus, even if we did decide to fully replace TLS, nothing would necessarily need to happen with certificates. We call them "SSL certificates", but the certificate standard - X.509 - actually predates SSLv1 by several years. A TLS alternative/replacement could adopt the X.509 standard as its certificate format and automatically work with the existing CA system.