3 ms·

> In practice, it will mean asking the DNS first to check if HTTP/3 can be used. Looking at the (draft) DNS specs for HTTPSSVC records [0] it seems that there'

> In practice, it will mean asking the DNS first to check if HTTP/3 can be used. Looking at the (draft) DNS specs for HTTPSSVC records [0] it seems that there's also the equivalence of SRV records? (SRV records is something that the browsers have never implemented) I recall a semi-recent discussion about the prevalence of CDNs and what options there are for smaller players and DIY-ers and how SRV could have had a role in that [1]. I'm really looking forward to the spec rolling out if this is the case! (There's a little example given in the Appendix of the DNS specs [2]) [0] https://tools.ietf.org/html/draft-ietf-dnsop-svcb-httpssvc-01 https://tools.ietf.org/html/draft-ietf-dnsop-svcb-httpssvc-0... [1] https://news.ycombinator.com/item?id=22073098 https://news.ycombinator.com/item?id=22073098 [2] https://tools.ietf.org/html/draft-ietf-dnsop-svcb-httpssvc-01#appendix-A.1 https://tools.ietf.org/html/draft-ietf-dnsop-svcb-httpssvc-0...

tialaramex 7y ago
Yes, Alt-Svc just isn't practically faster unless you're constantly back to that particular site so a DNS solution had to be on the table, and (the current assumed path for) eSNI assumes a DNS solution too. It will be interesting to see which is the biggest deployability headache out of QUIC itself (UDP doesn't work for a noticeable fraction of users) and HTTPSSVC (not only will lots of people who have a shiny new HTTP/3-capable server not have a DNS server that understands HTTPSSVC lots of their clients have DNS servers which reject queries they don't understand outright). Remember it was about a year between TLS 1.3 being finished and being really finished, because the standard that was cryptographically sound and made sense from an engineering perspective couldn't be deployed - what we've got now is that protocol seen through a funhouse mirror that lets it pass middleboxes. For example the version field where you'd write TLS 1.3 (actually in a sense SSL 4.2 or maybe SSL 5) you can't do that. To sneak past a middlebox say instead that you're TLS 1.2 like it expects, and furthermore, you are re-connecting. It shouldn't worry that it can't understand the rest of what you say because you're just re-connecting - it must have approved that previous connection and so logically this one is likewise fine. Actually remembering which such connections have happened would cost money and isn't required to make the test pass so the middlebox doesn't do that and many will just allow all re-connections past untouched.

tialaramex 7y ago

Yes, Alt-Svc just isn't practically faster unless you're constantly back to that particular site so a DNS solution had to be on the table, and (the current assumed path for) eSNI assumes a DNS solution too. It will be interesting to see which is the biggest deployability headache out of QUIC itself (UDP doesn't work for a noticeable fraction of users) and HTTPSSVC (not only will lots of people who have a shiny new HTTP/3-capable server not have a DNS server that understands HTTPSSVC lots of their clients have DNS servers which reject queries they don't understand outright). Remember it was about a year between TLS 1.3 being finished and being really finished, because the standard that was cryptographically sound and made sense from an engineering perspective couldn't be deployed - what we've got now is that protocol seen through a funhouse mirror that lets it pass middleboxes. For example the version field where you'd write TLS 1.3 (actually in a sense SSL 4.2 or maybe SSL 5) you can't do that. To sneak past a middlebox say instead that you're TLS 1.2 like it expects, and furthermore, you are re-connecting. It shouldn't worry that it can't understand the rest of what you say because you're just re-connecting - it must have approved that previous connection and so logically this one is likewise fine. Actually remembering which such connections have happened would cost money and isn't required to make the test pass so the middlebox doesn't do that and many will just allow all re-connections past untouched.