4 ms·

I wish they would target a real issues of http. For example adding a proper session support and getting rid of cookies.

by takeda 7y ago

romaniv 7y ago
Do you seriously expect Google and Cloudflate to make basic web development easier when they are making tons of money by "managing" its complexity for others? It's in their best interest to make hosting your own content or using smaller hosting providers absolute hell. Just like it's in Google's best interest to make browsers so complex that other browser devs just give up and Chrome derivatives become the only choice. I'm predicting that eventually Google will start deranking HTTP 1.1 websites.
- IfOnlyYouKnew 7y ago
  I have no idea how cookies are supposed to having an impact on hosting in Google's cloud vs your own hardware, or why Google would care about people where something like that is in any way significant.
  - gambler 7y ago
    >I have no idea how cookies are supposed to having an impact on hosting in Google's cloud vs your own hardware You do not see how lack of built-in authentication increases complexity of implementing your own website as opposed to "outsourcing" stuff to Gmail, Google Docs and so on? You don't see the zillion "sign in with Google" buttons all over the web? You don't see how cookies are abused for tracking, which benefits Google orders of magnitude more than it would a smaller company?
    - y4mi 7y ago
      Do you even know what "sign in with Google" means? It's in no way easier than adding keycloak authentication for example, which is another (selfhosted) external authentication solution. Social auth isnt there to make authentication easier for the website owner. He still has to do everything he'd have to do if he didn't use it. It's there for the users, do they don't need to remember a bazillion passwords
  - tptacek 7y ago
    The reality is that Google is working as hard on getting rid of cookies as any organization on the Internet.
    - gambler 7y ago
      What you're saying: Google, a multi-billion dollar corporation that owns most of the browser and search market share, a company that dictates the next transport-layer protocol we will use - this company struggles to design a session-handling mechanism that would out-compete an ugly hack that Netscape ductaped to HTTP in mid-90s.
      - tptacek 7y ago
        Correct.
vbezhenar 7y ago
how session support is different from cookie?
- takeda 7y ago
  Session support is what cookies were supposed to solve, a proper support would make things simpler and not allow to abuse cookies for other things.
  - thecopy 7y ago
    Could upu clarify what you mean with proper support for sessions?
    - takeda 7y ago
      I think phk said it[1] best [1] https://varnish-cache.org/docs/trunk/phk/http20.html#beating-http-1-1 https://varnish-cache.org/docs/trunk/phk/http20.html#beating...
  - zeroimpl 7y ago
    I suppose you'd rather they'd have named the headers "Session-Id" and "Set-Session-Id"?
  - lone_haxx0r 7y ago
    And how would you not allow to abuse this session system? Would you make it more 'transactional' than cookies or what?
beetheking 7y ago
Out of curiosity, what benefit would getting rid of cookies have? And what would be a better way to implement a similar feature?
- takeda 7y ago
  Better privacy, simplicity etc. Cookies were a hack to add sessions on top of http.
  - krferriter 7y ago
    I don't understand how moving to another session system would be a benefit. What kind of thing are you proposing here?
    - takeda 7y ago
      PHK mentioned it[1] when http/2 was being discussed. I pretty much agree with his opinion about it. [1] https://varnish-cache.org/docs/trunk/phk/http20.html#beating-http-1-1 https://varnish-cache.org/docs/trunk/phk/http20.html#beating...
rurban 7y ago
The whole idea of HTTP and it's huge win over other server protocols was that it moved session support from the server to the client. You are talking nonsense here. cookies were needed for session persistency eventually.

I wish they would target a real issues of http. For example adding a proper session support and getting rid of cookies.

by takeda 7y ago

I wish they would target a real issues of http. For example adding a proper session support and getting rid of cookies.

Do you seriously expect Google and Cloudflate to make basic web development easier when they are making tons of money by "managing" its complexity for others? It's in their best interest to make hosting your own content or using smaller hosting providers absolute hell. Just like it's in Google's best interest to make browsers so complex that other browser devs just give up and Chrome derivatives become the only choice. I'm predicting that eventually Google will start deranking HTTP 1.1 websites.

IfOnlyYouKnew 7y ago
I have no idea how cookies are supposed to having an impact on hosting in Google's cloud vs your own hardware, or why Google would care about people where something like that is in any way significant.
- gambler 7y ago
  >I have no idea how cookies are supposed to having an impact on hosting in Google's cloud vs your own hardware You do not see how lack of built-in authentication increases complexity of implementing your own website as opposed to "outsourcing" stuff to Gmail, Google Docs and so on? You don't see the zillion "sign in with Google" buttons all over the web? You don't see how cookies are abused for tracking, which benefits Google orders of magnitude more than it would a smaller company?
  - y4mi 7y ago
    Do you even know what "sign in with Google" means? It's in no way easier than adding keycloak authentication for example, which is another (selfhosted) external authentication solution. Social auth isnt there to make authentication easier for the website owner. He still has to do everything he'd have to do if he didn't use it. It's there for the users, do they don't need to remember a bazillion passwords
- tptacek 7y ago
  The reality is that Google is working as hard on getting rid of cookies as any organization on the Internet.
  - gambler 7y ago
    What you're saying: Google, a multi-billion dollar corporation that owns most of the browser and search market share, a company that dictates the next transport-layer protocol we will use - this company struggles to design a session-handling mechanism that would out-compete an ugly hack that Netscape ductaped to HTTP in mid-90s.
    - tptacek 7y ago
      Correct.

vbezhenar 7y ago

how session support is different from cookie?

takeda 7y ago
Session support is what cookies were supposed to solve, a proper support would make things simpler and not allow to abuse cookies for other things.
- thecopy 7y ago
  Could upu clarify what you mean with proper support for sessions?
  - takeda 7y ago
    I think phk said it[1] best [1] https://varnish-cache.org/docs/trunk/phk/http20.html#beating-http-1-1 https://varnish-cache.org/docs/trunk/phk/http20.html#beating...
- zeroimpl 7y ago
  I suppose you'd rather they'd have named the headers "Session-Id" and "Set-Session-Id"?
- lone_haxx0r 7y ago
  And how would you not allow to abuse this session system? Would you make it more 'transactional' than cookies or what?

beetheking 7y ago

Out of curiosity, what benefit would getting rid of cookies have? And what would be a better way to implement a similar feature?

takeda 7y ago
Better privacy, simplicity etc. Cookies were a hack to add sessions on top of http.
- krferriter 7y ago
  I don't understand how moving to another session system would be a benefit. What kind of thing are you proposing here?
  - takeda 7y ago
    PHK mentioned it[1] when http/2 was being discussed. I pretty much agree with his opinion about it. [1] https://varnish-cache.org/docs/trunk/phk/http20.html#beating-http-1-1 https://varnish-cache.org/docs/trunk/phk/http20.html#beating...

rurban 7y ago

The whole idea of HTTP and it's huge win over other server protocols was that it moved session support from the server to the client. You are talking nonsense here. cookies were needed for session persistency eventually.