4 ms·
It's simple if you pull in a dependency on a library that does it for you, but that's just putting the complexity in the library. HTTP is a complex protocol, TL
by zrm 7y ago
It's simple if you pull in a dependency on a library that does it for you, but that's just putting the complexity in the library. HTTP is a complex protocol, TLS is a complex protocol, even just using TCP isn't exactly simple or advantageous to response latency.
- tptacek 7y agoTLS is a complex protocol with trusted mainstream implementations (even OpenSSL, at this point, is a fine option).
- zrm 7y agoTrusted mainstream implementations come from use. You might get the same number of vulnerabilities from a green new DNSCurve library as from old battered OpenSSL because you're trading off the protocol complexity against the years of grinding away at all the bugs, but that only gets you to parity. Which itself only lasts until the DNSCurve library is trusted and mainstream and claims the advantage because the younger code matures but the protocol stays simpler. In the meantime DoH still has worse latency because of the extra round trips. Especially in the authoritative case where you're typically making few queries each to many authoritative servers instead of making many queries to one recursive resolver and you can't reuse the one handshake for all your queries.
- josteink 7y ago> TLS is a complex protocol with trusted mainstream implementations (even OpenSSL, at this point, is a fine option). Trusted for now. How long until the next heartbleed? Do you want that vulnerability embedded in billions of unupdatable IoT-devices?