3 ms·

if we could magically do not care about compatibility how we could redesign/rewrite internet now in order to make it better? what could've been done better?

if we could magically do not care about compatibility how we could redesign/rewrite internet now in order to make it better? what could've been done better? how better performance could be?

Ayesh 5y ago
I would start by: - Not allocating giant slices of IPv6/4 space to corporations or government agencies. Everything must be IPv6. - Adding proper authentication to BGP. - Taking off the super powers of CAs - Not piling up standards on DNS. - Killing ICANN because it turned out to be a greedy senseless organization. - HTTPS is the standard, and email servers just follow the auth/encryption just like HTTPS. - Curve/Ed25519 over P256/386 and RSA. - TLS 1.3 is the standard, and remove all compromises made to keep the middle boxes happy. - No PSL. Browser same-origin modal everywhere.
- tester34 5y ago
  Well, I expected more radical/foundational changes than "upgrade to $modern standards" :P e.g change TCP to $YOLO PROTOCOL, get rid of OSI for something different
  - deleted 5y ago
    [deleted]
  - cesarb 5y ago
    My own radical ideas would be: 1. Change the order of the header fields to have the destination first, then the source; 2. Make the behavior on too large packets be "truncate but still forward" (setting a flag saying this was done), instead of fragmenting or dropping with an ICMP message.
- tialaramex 5y ago
  If you want a PKI, the Certificate Authority role comes with that. If Alice wants to know something about Bob, either Alice must have this aprori knowledge, or else some third party Trent trusted by both Alice and Bob is involved. The Certificate Authority is Trent. TLS 1.3 has the "compromises made to keep the middle boxes happy" built into it. A Semantically equivalent protocol, which is spelled differently (and thus incompatible with middle boxes in the real world so you could never deploy it) would have the exact same provable security properties, but that isn't TLS 1.3. ekr's "Compact TLS" is roughly this. The trick most often seen in clients (particularly web browsers) implementing TLS 1.2 and earlier, of downgrading and trying again, does not exist in TLS 1.3. If you call a TLS 1.3 server, falsely believing that it is only allowed to speak TLS 1.2 to you and so you should not claim to know TLS 1.3, the server will, unsolicited, signal that it does know TLS 1.3 anyway and your client drops the connection. This feature, called Downgrade Protection, was not enabled in Chrome for about a year because - of course - middlebox vendors can't do anything right, but after a 12 month "fix it or else" warning Chrome enabled the feature.
iovoid 5y ago
Interesting RIPE labs article about a more foundational change that could be made: https://labs.ripe.net/author/hausheer/scion-a-novel-internet-architecture/ https://labs.ripe.net/author/hausheer/scion-a-novel-internet...

if we could magically do not care about compatibility how we could redesign/rewrite internet now in order to make it better? what could've been done better? how better performance could be?

Ayesh 5y ago

I would start by: - Not allocating giant slices of IPv6/4 space to corporations or government agencies. Everything must be IPv6. - Adding proper authentication to BGP. - Taking off the super powers of CAs - Not piling up standards on DNS. - Killing ICANN because it turned out to be a greedy senseless organization. - HTTPS is the standard, and email servers just follow the auth/encryption just like HTTPS. - Curve/Ed25519 over P256/386 and RSA. - TLS 1.3 is the standard, and remove all compromises made to keep the middle boxes happy. - No PSL. Browser same-origin modal everywhere.

tester34 5y ago
Well, I expected more radical/foundational changes than "upgrade to $modern standards" :P e.g change TCP to $YOLO PROTOCOL, get rid of OSI for something different
- deleted 5y ago
  [deleted]
- cesarb 5y ago
  My own radical ideas would be: 1. Change the order of the header fields to have the destination first, then the source; 2. Make the behavior on too large packets be "truncate but still forward" (setting a flag saying this was done), instead of fragmenting or dropping with an ICMP message.
tialaramex 5y ago
If you want a PKI, the Certificate Authority role comes with that. If Alice wants to know something about Bob, either Alice must have this aprori knowledge, or else some third party Trent trusted by both Alice and Bob is involved. The Certificate Authority is Trent. TLS 1.3 has the "compromises made to keep the middle boxes happy" built into it. A Semantically equivalent protocol, which is spelled differently (and thus incompatible with middle boxes in the real world so you could never deploy it) would have the exact same provable security properties, but that isn't TLS 1.3. ekr's "Compact TLS" is roughly this. The trick most often seen in clients (particularly web browsers) implementing TLS 1.2 and earlier, of downgrading and trying again, does not exist in TLS 1.3. If you call a TLS 1.3 server, falsely believing that it is only allowed to speak TLS 1.2 to you and so you should not claim to know TLS 1.3, the server will, unsolicited, signal that it does know TLS 1.3 anyway and your client drops the connection. This feature, called Downgrade Protection, was not enabled in Chrome for about a year because - of course - middlebox vendors can't do anything right, but after a 12 month "fix it or else" warning Chrome enabled the feature.

iovoid 5y ago

Interesting RIPE labs article about a more foundational change that could be made: https://labs.ripe.net/author/hausheer/scion-a-novel-internet-architecture/ https://labs.ripe.net/author/hausheer/scion-a-novel-internet...