3 ms·

What was once HTTP being a simple protocol with a simple syntax has ballooned into a monstrosity. And none of the lessons learned about and from other protocol

What was once HTTP being a simple protocol with a simple syntax has ballooned into a monstrosity. And none of the lessons learned about and from other protocols. Part of the problem is too many hands in the cookie jar. Put it back under a single research lab group, something like DARPA or Bell Labs. This is from the mind of a high-speed IPS/IDS architect.

pornel 5y ago
It's the "simple" text-based nature of HTTP that keeps biting it. It's the source of parsing complexity (it's really nasty when you need to handle all the weird "web-compatible" edge cases and not be vulnerable to things like request smuggling). In this RFC it increases complexity due to the need for normalization.
tenebrisalietum 5y ago
The blame chain is this: - Microsoft is king of the corporate PC in the early-to-mid 90's. - Internet and it's Unix-y origins starts getting popular. - Windows was not fundamentally designed to be connected to an open global network and Windows/Microsoft product security issues start becoming constant and prevalent. - This causes an antivirus/security industry to start and grow, hooking into PC pop culture, corporate/government life which causes recommendations such as "block everything except outgoing TCP 80 and 443" to be implemented large-scale. - Microsoft is getting better but is so prevalent that it becomes the substrate for things like major ransomware operations. The cloud becomes a thing and cloud-based firewalls that are basically HTTP proxies start becoming a thing. - So now everything has to be HTTP otherwise it requires network owners to reconfigure firewalls and potentially take blame for ever-escalating security incidents. Just easier to ride HTTP.
jedisct1 5y ago
I too miss the days where I could use "telnet 80" to interact with a web server. And when a website could be made by writing simple HTML/CSS code, and hosted anywhere, even by your own ISP. Yes, HTTP has become a monstrosity. Something that's incredibly hard to comprehend and implement. It just got even worse with HTTP/3 that replaces TCP with QUIC. On the other hand, HTTP has become a little bit more than just a protocol for serving web pages. It's become a universal transport protocol for everything: small content, very large content, interactive content, streamed content, public content, sensitive content, APIs, iOT... With being able to be a good fit for all these radically different use cases come a lot of complexity. It's a tradeoff. And HTTP is actually doing an amazing job at balancing complexity vs being a universal protocol.

pornel 5y ago

It's the "simple" text-based nature of HTTP that keeps biting it. It's the source of parsing complexity (it's really nasty when you need to handle all the weird "web-compatible" edge cases and not be vulnerable to things like request smuggling). In this RFC it increases complexity due to the need for normalization.

tenebrisalietum 5y ago

The blame chain is this: - Microsoft is king of the corporate PC in the early-to-mid 90's. - Internet and it's Unix-y origins starts getting popular. - Windows was not fundamentally designed to be connected to an open global network and Windows/Microsoft product security issues start becoming constant and prevalent. - This causes an antivirus/security industry to start and grow, hooking into PC pop culture, corporate/government life which causes recommendations such as "block everything except outgoing TCP 80 and 443" to be implemented large-scale. - Microsoft is getting better but is so prevalent that it becomes the substrate for things like major ransomware operations. The cloud becomes a thing and cloud-based firewalls that are basically HTTP proxies start becoming a thing. - So now everything has to be HTTP otherwise it requires network owners to reconfigure firewalls and potentially take blame for ever-escalating security incidents. Just easier to ride HTTP.

jedisct1 5y ago

I too miss the days where I could use "telnet 80" to interact with a web server. And when a website could be made by writing simple HTML/CSS code, and hosted anywhere, even by your own ISP. Yes, HTTP has become a monstrosity. Something that's incredibly hard to comprehend and implement. It just got even worse with HTTP/3 that replaces TCP with QUIC. On the other hand, HTTP has become a little bit more than just a protocol for serving web pages. It's become a universal transport protocol for everything: small content, very large content, interactive content, streamed content, public content, sensitive content, APIs, iOT... With being able to be a good fit for all these radically different use cases come a lot of complexity. It's a tradeoff. And HTTP is actually doing an amazing job at balancing complexity vs being a universal protocol.