5 ms·

HTTP2 has been created for big players. When you are a small team, benefits from it are not that interesting. Plus mandatory TLS is making boostraping a project

HTTP2 has been created for big players. When you are a small team, benefits from it are not that interesting. Plus mandatory TLS is making boostraping a project unnecessary hard.

fredsir 10y ago
If you mean bootstrapping a webservice-project, I don't believe it's hard in any way. With offerings like Lets Encrypts, it's incredibly easy and takes no more than 20 minutes.
- dijit 10y ago
  Bootstrapping using letsecrypt requires an internet connection and a public facing service. I can say that 14 year old me, who had books, a pc and no internet would have been screwed by this.
  - icebraining 10y ago
    If you're just using it locally, you can use a self-signed cert. Caddy generates one automatically by just adding "self_signed" to your config[1]. Or you can copy-paste a single OpenSSL or PowerShell command to generate one. [1]: https://caddyserver.com/blog/caddy-0_9-released#easy-self-signed-certificates https://caddyserver.com/blog/caddy-0_9-released#easy-self-si...
    - drcongo 10y ago
      I tried out Caddy on a project the other day, it was incredibly simple to set up HTTP2 with Let's Encrypt.
    - dijit 10y ago
      This is the closest thing to reasonable that anybody has suggested. I seem to be getting brigaded by the encryption cargo cult and while I agree that nothing public facing should not have encryption it's a different thing to force all developing students to learn TLS/SSL before they start actually learning to code. I expressed dissatisfaction with the fact that learning to code for the web has a barrier to entry now that can be very difficult for various reasons. Learning To debug TLS issues is another problem in of itself which often takes a lot of years to fully understand. A new programmer should be very aware of the tools that are available to make this easier. But 14 year old me with a php book and no internet did not have such luxuries and that was all I said.
      - sametmax 10y ago
        People downvoting you completely forgot how it was when they started. They don't see the huge gap between us now, experts, and the beginners arriving on the market. In the quest of making our field more professional, we failed to make it gradual improvements.
      - pixl97 10y ago
        The difference between 14 year old you and now, is that crappy php app you made then might have made it years before it was hacked. These days it could last just minutes. The problem here is you are thinking about just yourself. Yes, it's hard to do learn all these things. It was especially hard back then because the the sources to learn were pretty crappy and taught a lot of bad things. That's part of the reason we have the 'exploit a day' internet we suffer from now. If new web developers have to learn both protocol security and code development, it will probably mean less developers. Which is great for the ones that take the time to learn, they'll get paid more. It also is probably better for the customer, hopefully it will mean they are less likely to get served virus_porn_encrypt-your-computer.exe from your half baked website.
    - sametmax 10y ago
      But this implies you can then deploy your caddy server. Which means a private server with root rights. Do you realize most devs don't even know server admin ? If you know the command line, you are not most dev. You are far, far away from the reality of enterprise software. Tomcat and apache are still massively deployed. If you moved to nginx years ago, remember than it's still a new toy for a huge number of people. So caddy...
      - openasocket 10y ago
        You don't need caddy, you just need a self-signed cert, which is pretty easy to generate.
      - vetinari 10y ago
        Apache is easy to configure with TLS or Let's Encrypt. The only unfortunate thing is, that RHEL7/CentOS7 have OpenSSL 1.0.1 and mod_http2 requires OpenSSL 1.0.2. Thus no http2 there.
      - jonathanoliver 10y ago
        Caddy doesn't require root. You can easily use systemd/upstart/custom scripts to run as an unprivileged user.
  - metafunctor 10y ago
    Pardon my ignorance, but how will the 14 year old you create a website without an internet connection and a public facing service? If you can create one, presumably for your internal network, with no public facing parts, how exactly does letsencrypt "screw you"? You can create and distribute self-signed certificates today, just like you could the past 20 years.
    - dijit 10y ago
      If I'm required to use SSL to do hello world using php/mysql then that definitely is a turn-off.
      - DorothySim 10y ago
        You are not required to use SSL to do hello world. You are required to use SSL if you want to use HTTP2 (yes, I know about h2c).
  - stephen_g 10y ago
    I'm confused - because the presence of HTTP2 means that HTTP no longer exists? Browsers will still support HTTP in a decade (current low-powered network hardware and the like will still be around and need to work).
- sametmax 10y ago
  It's 20 minutes only if you are exactly in the regular use case and already know what you are doing. And it's 20 minutes for one thing. Imagine if each little detail of your setup would take 20 minutes. And of course down the road you will have to figure out subdomains, cross domain requests, media streaming, embedding external unsecure content, debugging on mobile devices, etc. And of course this will work only if you are on a private server, cause on the simplest hosting you won't have this. You lost touch with the quantity of knowledge you accumulated over the years.
  - pixl97 10y ago
    > embedding external unsecure content, There is an easy answer to that. DON'T Most browsers block it at this point, and rightfully so. A single unencrypted include can be used to inject malicious content on a web page. Lots of people use internet over untrusted connections (open wireless) or partially trusted connections (ISPs injecting content). >You lost touch with the quantity of knowledge you accumulated over the years. Therefore we must lobby that our skill set is protected by law and that protocols and best practices are not allowed to change! Uh? Sorry man, you are going to have to evolve as the internet changes. Well, you don't have to, but when all your devices are encrypted and asking for a few bit coins to unlock, you will have been warned that it was going to happen.
    - sametmax 10y ago
      > There is an easy answer to that. > DON'T Easy to say when your business is no tied to advertisers on which you have zero leverage. > Therefore we must lobby that our skill set is protected by law and that protocols and best practices are not allowed to change! Making TLS optional on HTTP2 would have not taken anything from you. You are just here in your ivory tower looking down on people that are clearly not as pure as your are. Well sorry, but down there, among the humans, you have PHP dev that are using EasyPHP, people that don't know the command line, people using mixed content and have no control over it, people that can't spend hours to continuously learn new things every week, people that don't have private servers and so on. And you know what ? I'm not even among them. I run my service on private servers with https. I use docker, letsencrypt and react or whatever is useful to me. But giving trainings and having friends running side business, I know that it's not the only reality in IT. So basically, right now, HTTP2 is just built to be hard for a huge part of the dev population, with no good reasons.
acjohnson55 10y ago
So, don't use it. It's not as though you're being forced to upgrade.
- sametmax 10y ago
  But soon everybody will be. It's not for me. I will always be alright. But I know many people that will be left behind. On HN, users completely fail to relate to regular devs.
frik 10y ago
You are right. More and more propaganda these days to steer the crowd to things were only the top players benefit. HTTP 0.9/1.x with or without TLS (aka HTTPS) is still relevant. And making TLS mandatory is a very bad decisions, it will hurt every dev who had to touch lower level APIs or do performance optimization or debugging a lot. Sometimes it would help to think a bit father then ones nose is long.
- pixl97 10y ago
  >it will hurt every dev who had to touch lower level APIs or do performance optimization or debugging a lot Cry me a river. Devs want to pump out as much code as possible without thinking about the security considerations. Who cares about the end user that's going to get pwned, right? HTTP is being phased out. HTTPS certs are available for free. Companies can use self generated certs if needed. The days of exchanging unencrypted text over the internet and blindly expecting some evil or ignorant 3rd party not to tamper with it is long gone.
  - nathanaldensr 10y ago
    There's no need to get aggressive. It will suck to have to resort to essentially MITM tactics on my developer workstation in order to decrypt local traffic. Yes, there are tools like Fiddler that can do this, but eventually it may be impossible to MITM traffic the way Fiddler does. That will make it more difficult to debug applications. There are also platforms like Pivotal Cloud Foundry that rely on being able to inject headers into HTTP messages as the messages traverse the platform (e.g., to support throttling); this will become more difficult if that traffic has to be encrypted. HTTP/2 with forced TLS is, in effect, a binary protocol. Right now, developers all over the world enjoy the plain-text and hackable nature of HTTP 1.x.
    - Arcsech 10y ago
      I'm not sure why it would become impossible to do what Fiddler does. It's not like any major platform is going to stop letting you add root certificates.

HTTP2 has been created for big players. When you are a small team, benefits from it are not that interesting. Plus mandatory TLS is making boostraping a project unnecessary hard.

fredsir 10y ago

If you mean bootstrapping a webservice-project, I don't believe it's hard in any way. With offerings like Lets Encrypts, it's incredibly easy and takes no more than 20 minutes.

dijit 10y ago
Bootstrapping using letsecrypt requires an internet connection and a public facing service. I can say that 14 year old me, who had books, a pc and no internet would have been screwed by this.
- icebraining 10y ago
  If you're just using it locally, you can use a self-signed cert. Caddy generates one automatically by just adding "self_signed" to your config[1]. Or you can copy-paste a single OpenSSL or PowerShell command to generate one. [1]: https://caddyserver.com/blog/caddy-0_9-released#easy-self-signed-certificates https://caddyserver.com/blog/caddy-0_9-released#easy-self-si...
  - drcongo 10y ago
    I tried out Caddy on a project the other day, it was incredibly simple to set up HTTP2 with Let's Encrypt.
  - dijit 10y ago
    This is the closest thing to reasonable that anybody has suggested. I seem to be getting brigaded by the encryption cargo cult and while I agree that nothing public facing should not have encryption it's a different thing to force all developing students to learn TLS/SSL before they start actually learning to code. I expressed dissatisfaction with the fact that learning to code for the web has a barrier to entry now that can be very difficult for various reasons. Learning To debug TLS issues is another problem in of itself which often takes a lot of years to fully understand. A new programmer should be very aware of the tools that are available to make this easier. But 14 year old me with a php book and no internet did not have such luxuries and that was all I said.
    - sametmax 10y ago
      People downvoting you completely forgot how it was when they started. They don't see the huge gap between us now, experts, and the beginners arriving on the market. In the quest of making our field more professional, we failed to make it gradual improvements.
    - pixl97 10y ago
      The difference between 14 year old you and now, is that crappy php app you made then might have made it years before it was hacked. These days it could last just minutes. The problem here is you are thinking about just yourself. Yes, it's hard to do learn all these things. It was especially hard back then because the the sources to learn were pretty crappy and taught a lot of bad things. That's part of the reason we have the 'exploit a day' internet we suffer from now. If new web developers have to learn both protocol security and code development, it will probably mean less developers. Which is great for the ones that take the time to learn, they'll get paid more. It also is probably better for the customer, hopefully it will mean they are less likely to get served virus_porn_encrypt-your-computer.exe from your half baked website.
  - sametmax 10y ago
    But this implies you can then deploy your caddy server. Which means a private server with root rights. Do you realize most devs don't even know server admin ? If you know the command line, you are not most dev. You are far, far away from the reality of enterprise software. Tomcat and apache are still massively deployed. If you moved to nginx years ago, remember than it's still a new toy for a huge number of people. So caddy...
    - openasocket 10y ago
      You don't need caddy, you just need a self-signed cert, which is pretty easy to generate.
    - vetinari 10y ago
      Apache is easy to configure with TLS or Let's Encrypt. The only unfortunate thing is, that RHEL7/CentOS7 have OpenSSL 1.0.1 and mod_http2 requires OpenSSL 1.0.2. Thus no http2 there.
    - jonathanoliver 10y ago
      Caddy doesn't require root. You can easily use systemd/upstart/custom scripts to run as an unprivileged user.
- metafunctor 10y ago
  Pardon my ignorance, but how will the 14 year old you create a website without an internet connection and a public facing service? If you can create one, presumably for your internal network, with no public facing parts, how exactly does letsencrypt "screw you"? You can create and distribute self-signed certificates today, just like you could the past 20 years.
  - dijit 10y ago
    If I'm required to use SSL to do hello world using php/mysql then that definitely is a turn-off.
    - DorothySim 10y ago
      You are not required to use SSL to do hello world. You are required to use SSL if you want to use HTTP2 (yes, I know about h2c).
- stephen_g 10y ago
  I'm confused - because the presence of HTTP2 means that HTTP no longer exists? Browsers will still support HTTP in a decade (current low-powered network hardware and the like will still be around and need to work).
sametmax 10y ago
It's 20 minutes only if you are exactly in the regular use case and already know what you are doing. And it's 20 minutes for one thing. Imagine if each little detail of your setup would take 20 minutes. And of course down the road you will have to figure out subdomains, cross domain requests, media streaming, embedding external unsecure content, debugging on mobile devices, etc. And of course this will work only if you are on a private server, cause on the simplest hosting you won't have this. You lost touch with the quantity of knowledge you accumulated over the years.
- pixl97 10y ago
  > embedding external unsecure content, There is an easy answer to that. DON'T Most browsers block it at this point, and rightfully so. A single unencrypted include can be used to inject malicious content on a web page. Lots of people use internet over untrusted connections (open wireless) or partially trusted connections (ISPs injecting content). >You lost touch with the quantity of knowledge you accumulated over the years. Therefore we must lobby that our skill set is protected by law and that protocols and best practices are not allowed to change! Uh? Sorry man, you are going to have to evolve as the internet changes. Well, you don't have to, but when all your devices are encrypted and asking for a few bit coins to unlock, you will have been warned that it was going to happen.
  - sametmax 10y ago
    > There is an easy answer to that. > DON'T Easy to say when your business is no tied to advertisers on which you have zero leverage. > Therefore we must lobby that our skill set is protected by law and that protocols and best practices are not allowed to change! Making TLS optional on HTTP2 would have not taken anything from you. You are just here in your ivory tower looking down on people that are clearly not as pure as your are. Well sorry, but down there, among the humans, you have PHP dev that are using EasyPHP, people that don't know the command line, people using mixed content and have no control over it, people that can't spend hours to continuously learn new things every week, people that don't have private servers and so on. And you know what ? I'm not even among them. I run my service on private servers with https. I use docker, letsencrypt and react or whatever is useful to me. But giving trainings and having friends running side business, I know that it's not the only reality in IT. So basically, right now, HTTP2 is just built to be hard for a huge part of the dev population, with no good reasons.

acjohnson55 10y ago

So, don't use it. It's not as though you're being forced to upgrade.

sametmax 10y ago
But soon everybody will be. It's not for me. I will always be alright. But I know many people that will be left behind. On HN, users completely fail to relate to regular devs.

frik 10y ago

You are right. More and more propaganda these days to steer the crowd to things were only the top players benefit. HTTP 0.9/1.x with or without TLS (aka HTTPS) is still relevant. And making TLS mandatory is a very bad decisions, it will hurt every dev who had to touch lower level APIs or do performance optimization or debugging a lot. Sometimes it would help to think a bit father then ones nose is long.

pixl97 10y ago
>it will hurt every dev who had to touch lower level APIs or do performance optimization or debugging a lot Cry me a river. Devs want to pump out as much code as possible without thinking about the security considerations. Who cares about the end user that's going to get pwned, right? HTTP is being phased out. HTTPS certs are available for free. Companies can use self generated certs if needed. The days of exchanging unencrypted text over the internet and blindly expecting some evil or ignorant 3rd party not to tamper with it is long gone.
- nathanaldensr 10y ago
  There's no need to get aggressive. It will suck to have to resort to essentially MITM tactics on my developer workstation in order to decrypt local traffic. Yes, there are tools like Fiddler that can do this, but eventually it may be impossible to MITM traffic the way Fiddler does. That will make it more difficult to debug applications. There are also platforms like Pivotal Cloud Foundry that rely on being able to inject headers into HTTP messages as the messages traverse the platform (e.g., to support throttling); this will become more difficult if that traffic has to be encrypted. HTTP/2 with forced TLS is, in effect, a binary protocol. Right now, developers all over the world enjoy the plain-text and hackable nature of HTTP 1.x.
  - Arcsech 10y ago
    I'm not sure why it would become impossible to do what Fiddler does. It's not like any major platform is going to stop letting you add root certificates.