7 ms·

and it's not as good as it could've be. the statefulness makes it really really really really really akward.

by merb 10y ago

blowski 10y ago
I haven't worked with HTTP2 much - I thought it was still stateless. Are you referring to HPACK?
- merb 10y ago
  http://httpwg.org/specs/rfc7540.html#StreamStates http://httpwg.org/specs/rfc7540.html#StreamStates
  - lclarkmichalek 10y ago
    Man, just wait till you see the equivalent diagram for TCP.
    - jsnell 10y ago
      The equivalent RFC 793 diagram isn't that much more complex. It only gets properly messy once you look at the real TCP state transitions: https://www.cl.cam.ac.uk/~pes20/Netsem/poster.pdf https://www.cl.cam.ac.uk/~pes20/Netsem/poster.pdf
sametmax 10y ago
HTTP2 has been created for big players. When you are a small team, benefits from it are not that interesting. Plus mandatory TLS is making boostraping a project unnecessary hard.
- fredsir 10y ago
  If you mean bootstrapping a webservice-project, I don't believe it's hard in any way. With offerings like Lets Encrypts, it's incredibly easy and takes no more than 20 minutes.
  - dijit 10y ago
    Bootstrapping using letsecrypt requires an internet connection and a public facing service. I can say that 14 year old me, who had books, a pc and no internet would have been screwed by this.
    - icebraining 10y ago
      If you're just using it locally, you can use a self-signed cert. Caddy generates one automatically by just adding "self_signed" to your config[1]. Or you can copy-paste a single OpenSSL or PowerShell command to generate one. [1]: https://caddyserver.com/blog/caddy-0_9-released#easy-self-signed-certificates https://caddyserver.com/blog/caddy-0_9-released#easy-self-si...
      - drcongo 10y ago
        I tried out Caddy on a project the other day, it was incredibly simple to set up HTTP2 with Let's Encrypt.
      - dijit 10y ago
        This is the closest thing to reasonable that anybody has suggested. I seem to be getting brigaded by the encryption cargo cult and while I agree that nothing public facing should not have encryption it's a different thing to force all developing students to learn TLS/SSL before they start actually learning to code. I expressed dissatisfaction with the fact that learning to code for the web has a barrier to entry now that can be very difficult for various reasons. Learning To debug TLS issues is another problem in of itself which often takes a lot of years to fully understand. A new programmer should be very aware of the tools that are available to make this easier. But 14 year old me with a php book and no internet did not have such luxuries and that was all I said.
        sametmax 10y ago
        People downvoting you completely forgot how it was when they started. They don't see the huge gap between us now, experts, and the beginners arriving on the market. In the quest of making our field more professional, we failed to make it gradual improvements.
- acjohnson55 10y ago
  So, don't use it. It's not as though you're being forced to upgrade.
  - sametmax 10y ago
    But soon everybody will be. It's not for me. I will always be alright. But I know many people that will be left behind. On HN, users completely fail to relate to regular devs.
- frik 10y ago
  You are right. More and more propaganda these days to steer the crowd to things were only the top players benefit. HTTP 0.9/1.x with or without TLS (aka HTTPS) is still relevant. And making TLS mandatory is a very bad decisions, it will hurt every dev who had to touch lower level APIs or do performance optimization or debugging a lot. Sometimes it would help to think a bit father then ones nose is long.
  - pixl97 10y ago
    >it will hurt every dev who had to touch lower level APIs or do performance optimization or debugging a lot Cry me a river. Devs want to pump out as much code as possible without thinking about the security considerations. Who cares about the end user that's going to get pwned, right? HTTP is being phased out. HTTPS certs are available for free. Companies can use self generated certs if needed. The days of exchanging unencrypted text over the internet and blindly expecting some evil or ignorant 3rd party not to tamper with it is long gone.
    - nathanaldensr 10y ago
      There's no need to get aggressive. It will suck to have to resort to essentially MITM tactics on my developer workstation in order to decrypt local traffic. Yes, there are tools like Fiddler that can do this, but eventually it may be impossible to MITM traffic the way Fiddler does. That will make it more difficult to debug applications. There are also platforms like Pivotal Cloud Foundry that rely on being able to inject headers into HTTP messages as the messages traverse the platform (e.g., to support throttling); this will become more difficult if that traffic has to be encrypted. HTTP/2 with forced TLS is, in effect, a binary protocol. Right now, developers all over the world enjoy the plain-text and hackable nature of HTTP 1.x.
      - Arcsech 10y ago
        I'm not sure why it would become impossible to do what Fiddler does. It's not like any major platform is going to stop letting you add root certificates.
olavgg 10y ago
Agreed, I think PHK nails his concerns here: https://www.varnish-cache.org/docs/trunk/phk/http20.html https://www.varnish-cache.org/docs/trunk/phk/http20.html
merb 10y ago
btw. I don't talk about the forced TLS stuff. besides I'm working in a company who sells boxes for intranet's (where deploying TLS for domains is not always easy, lack of proper DNS or other things, etc...) The spec has just a lot of edge cases especially when handling state/what exactly is a specification violation. Especially handling clients who opened a connection and now are in closing state, can be really really tricky to handle. On the implementation side the Statefulness adds a lot of overhead, that HTTP/1.1 did not had (besides other flaws) I think HTTP/2 was a little bit rushed, but I guess HTTP/3 will clean up some stuff.

and it's not as good as it could've be. the statefulness makes it really really really really really akward.

by merb 10y ago

and it's not as good as it could've be. the statefulness makes it really really really really really akward.

blowski 10y ago

I haven't worked with HTTP2 much - I thought it was still stateless. Are you referring to HPACK?

merb 10y ago
http://httpwg.org/specs/rfc7540.html#StreamStates http://httpwg.org/specs/rfc7540.html#StreamStates
- lclarkmichalek 10y ago
  Man, just wait till you see the equivalent diagram for TCP.
  - jsnell 10y ago
    The equivalent RFC 793 diagram isn't that much more complex. It only gets properly messy once you look at the real TCP state transitions: https://www.cl.cam.ac.uk/~pes20/Netsem/poster.pdf https://www.cl.cam.ac.uk/~pes20/Netsem/poster.pdf

sametmax 10y ago

HTTP2 has been created for big players. When you are a small team, benefits from it are not that interesting. Plus mandatory TLS is making boostraping a project unnecessary hard.

fredsir 10y ago
If you mean bootstrapping a webservice-project, I don't believe it's hard in any way. With offerings like Lets Encrypts, it's incredibly easy and takes no more than 20 minutes.
- dijit 10y ago
  Bootstrapping using letsecrypt requires an internet connection and a public facing service. I can say that 14 year old me, who had books, a pc and no internet would have been screwed by this.
  - icebraining 10y ago
    If you're just using it locally, you can use a self-signed cert. Caddy generates one automatically by just adding "self_signed" to your config[1]. Or you can copy-paste a single OpenSSL or PowerShell command to generate one. [1]: https://caddyserver.com/blog/caddy-0_9-released#easy-self-signed-certificates https://caddyserver.com/blog/caddy-0_9-released#easy-self-si...
    - drcongo 10y ago
      I tried out Caddy on a project the other day, it was incredibly simple to set up HTTP2 with Let's Encrypt.
    - dijit 10y ago
      This is the closest thing to reasonable that anybody has suggested. I seem to be getting brigaded by the encryption cargo cult and while I agree that nothing public facing should not have encryption it's a different thing to force all developing students to learn TLS/SSL before they start actually learning to code. I expressed dissatisfaction with the fact that learning to code for the web has a barrier to entry now that can be very difficult for various reasons. Learning To debug TLS issues is another problem in of itself which often takes a lot of years to fully understand. A new programmer should be very aware of the tools that are available to make this easier. But 14 year old me with a php book and no internet did not have such luxuries and that was all I said.
      - sametmax 10y ago
        People downvoting you completely forgot how it was when they started. They don't see the huge gap between us now, experts, and the beginners arriving on the market. In the quest of making our field more professional, we failed to make it gradual improvements.
acjohnson55 10y ago
So, don't use it. It's not as though you're being forced to upgrade.
- sametmax 10y ago
  But soon everybody will be. It's not for me. I will always be alright. But I know many people that will be left behind. On HN, users completely fail to relate to regular devs.
frik 10y ago
You are right. More and more propaganda these days to steer the crowd to things were only the top players benefit. HTTP 0.9/1.x with or without TLS (aka HTTPS) is still relevant. And making TLS mandatory is a very bad decisions, it will hurt every dev who had to touch lower level APIs or do performance optimization or debugging a lot. Sometimes it would help to think a bit father then ones nose is long.
- pixl97 10y ago
  >it will hurt every dev who had to touch lower level APIs or do performance optimization or debugging a lot Cry me a river. Devs want to pump out as much code as possible without thinking about the security considerations. Who cares about the end user that's going to get pwned, right? HTTP is being phased out. HTTPS certs are available for free. Companies can use self generated certs if needed. The days of exchanging unencrypted text over the internet and blindly expecting some evil or ignorant 3rd party not to tamper with it is long gone.
  - nathanaldensr 10y ago
    There's no need to get aggressive. It will suck to have to resort to essentially MITM tactics on my developer workstation in order to decrypt local traffic. Yes, there are tools like Fiddler that can do this, but eventually it may be impossible to MITM traffic the way Fiddler does. That will make it more difficult to debug applications. There are also platforms like Pivotal Cloud Foundry that rely on being able to inject headers into HTTP messages as the messages traverse the platform (e.g., to support throttling); this will become more difficult if that traffic has to be encrypted. HTTP/2 with forced TLS is, in effect, a binary protocol. Right now, developers all over the world enjoy the plain-text and hackable nature of HTTP 1.x.
    - Arcsech 10y ago
      I'm not sure why it would become impossible to do what Fiddler does. It's not like any major platform is going to stop letting you add root certificates.

olavgg 10y ago

Agreed, I think PHK nails his concerns here: https://www.varnish-cache.org/docs/trunk/phk/http20.html https://www.varnish-cache.org/docs/trunk/phk/http20.html

merb 10y ago

btw. I don't talk about the forced TLS stuff. besides I'm working in a company who sells boxes for intranet's (where deploying TLS for domains is not always easy, lack of proper DNS or other things, etc...) The spec has just a lot of edge cases especially when handling state/what exactly is a specification violation. Especially handling clients who opened a connection and now are in closing state, can be really really tricky to handle. On the implementation side the Statefulness adds a lot of overhead, that HTTP/1.1 did not had (besides other flaws) I think HTTP/2 was a little bit rushed, but I guess HTTP/3 will clean up some stuff.