3 ms·
> What I don't get is why the industry has decided to force encryption with HTTP/2? For reliability and success of the protocol. "Reasons for choosing TLS-only
by mholt 10y ago
> What I don't get is why the industry has decided to force encryption with HTTP/2?
For reliability and success of the protocol. "Reasons for choosing TLS-only include respect for user's privacy and early measurements showing that the new protocols have a higher success rate when done with TLS. This is because of the widespread assumption that anything that goes over port 80 is HTTP 1.1, which makes some middle-boxes interfere with or destroy traffic when any other protocols are used on that port." (Source: http://http2-explained.haxx.se/content/en/part5.html http://http2-explained.haxx.se/content/en/part5.html)
Believe me, TLS is very much necessary in practice here.
- halomru 10y ago>This is because of the widespread assumption that anything that goes over port 80 is HTTP 1.1, which makes some middle-boxes interfere with or destroy traffic when any other protocols are used on that port. I'm not convinced that's a real problem once traffic leaves your servers/CDN. In practice I have seen lots of protocols use port 80, since 80 is the port that's most likely to be unrestricted on even the strictest corporate firewalls.
- noselasd 10y agoIt's a real problem. There are plenty of middle boxes around either at ISPs/cell operators or in residential gateways/modems that interfers on port 80.
- danudey 10y agoWe make mobile games for iOS and Android, and we've mostly switched to HTTPS because of people injecting garbage (ads, mostly) into our content.
- deleted 10y ago[deleted]