> First, running exactly one open port per IP (443 or 80) is the worst use of resources. The whole "crisis" could be solved with simple browser support of somet

> First, running exactly one open port per IP (443 or 80) is the worst use of resources. The whole "crisis" could be solved with simple browser support of something like SRV records. TLS SNI[1] and the HTTP Host: header[2] already do this. Enabling multiple HTTP(s) serving ports with something like SRV wouldn't give us any additional capacity here. > These institutions have exactly 0 business knowing how many physical devices are behind a firewall. These institutions can already analyze TTL, source port, IPid, and other packet metadata to enumerate hosts behind NAT.[3] [1]: https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication [2]: https://en.wikipedia.org/wiki/Virtual_hosting#Name-based https://en.wikipedia.org/wiki/Virtual_hosting#Name-based [3]: https://www.cs.columbia.edu/~smb/papers/fnat.pdf https://www.cs.columbia.edu/~smb/papers/fnat.pdf