6 ms·
What’s great about HTTP 1.1 is it’s simplicity. I mean, you can explain it to a complete newby and have that person write a functioning implementation in a few
by tambourine_man 5y ago
What’s great about HTTP 1.1 is it’s simplicity. I mean, you can explain it to a complete newby and have that person write a functioning implementation in a few lines of shell script, all in one afternoon.
In fact, you can probably figure it out by yourself just by looking at what goes across the wire.
And yet, it runs the whole modern world. That’s beautiful. I think simplicity is underrated and it’s something I really value when choosing the tools I use.
- tambourine_man 5y agoI’m pretty sure I’ll never understand QUIC completely in my lifetime. I do know HTTP 1.1 through and through (it’s really easy). The fact that HTTP 1.1 speeds are even comparable, let alone faster in some situations, should at least tip the scale in its favor.
- arpa 5y agoobscure standards mean less possibility that someone else without google-scale resources will implement their own client/server.
- ocdtrekkie 5y agoAnd that is one of the key "benefits" of HTTP/3 if you're a Google-scale company.
- bayesian_horse 5y agoExcept there are already several such implementations and nobody is going to deprecate older HTTP versions.
- giantrobot 5y agoChrome has an overwhelming portion of the web browser installed base. It's full of dark patterns and scary warnings about "dangerous" things like unencrypted HTTP. I don't have a lot of faith that they're not going to disable older HTTP versions at some point.
- TingPing 5y agoThere are many implementations of QUIC already, its quite diverse...
- bawolff 5y ago> The fact that HTTP 1.1 speeds are even comparable, let alone faster in some situations, should at least tip the scale in its favor. Are these realistic web browsing scenarios? Because that seems false. For most websites http/2 is a pretty significant performance win.
- cogman10 5y agoAre you sure you "know" HTTP 1.1 through and through? How much do you understand about gzip or brotili? How much do you know about TLS? Do you understand all of the functionality of TCP? Network congestion and checksuming? QUIC includes compression, encryption, and transport into the standard which is why it's more complicated. Just because Http 1.1 doesn't include those parts explicitly into the standard, doesn't mean they are unused. Http 1.1 is only "easy" because it sits atop a sea of complexity that rarely faces the same critiques as Quic does.
- WorldMaker 5y ago> I’m pretty sure I’ll never understand QUIC completely in my lifetime. Do you understand how to build TCP packets by hand? A lot of the confusion between QUIC and HTTP/3 is intentional because it is somewhat merging the layers that used to be entirely separate. All the examples elsewhere of "I can telnet/netcat to an HTTP/1.1 server and mostly do the thing" avoid the obvious fact that telnet/netcat is still doing all the work of splitting the messages into TCP packets and following TCP rules. Presumably QUIC and HTTP/3 are separate enough to still warrant the idea of a telnet/netcat for QUIC taking care of the low level details and then you could try to write HTTP/3 on top of those apps a little easier, in a similar fashion. Though maybe not, without the rich history of telnet-related protocols on top of TCP and HTTP/3 still currently the only protocol targeting QUIC today.
- Matthias247 5y agoComparing HTTP/1 to QUIC is apples to oranges. You would need to compare HTTP/1.1 to HTTP/3. And QUIC to a combination of TCP and TLS. Do you understand those through and through too - or are you just utilizing libraries to make them work? HTTP/3 is actually not super complex. The main trickiness comes from header compression. But unlike HTTP/2 the stateful QPACK compression part in HTTP/3 can actually be deactivated, and just the stateless static dictionary and huffmann compression being used.
- throw0101a 5y ago> What’s great about HTTP 1.1 is it’s simplicity. Perhaps I'm old fashioned, but I like being able to debug things with telnet/netcat. (Or openssl s_client.)
- Spivak 5y agoIsn’t this mostly a complaint about tooling? If getting the text form of a message just meant piping to a command would it be fine?
- notriddle 5y agoNot really. HTTP/1.1 already has enough complexity in it that most people can’t implement it securely (a legitimately simple protocol doesn’t have desync bugs). https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn https://portswigger.net/research/http-desync-attacks-request...
- nine_k 5y agoI'd say it has enough naïveté to be susceptible to desync attacks. Lax whitespace rules, lax repeating header rules, no advanced integrity checks like checksums, etc. I see these as signs of simplicity.
- tambourine_man 5y agoI think you're arguing for HTTP/1.2 instead
- RedShift1 5y agoWhy would you need checksums? There is already checksumming and error correction going on in the lower layers (TCP, Ethernet, ...).
- nine_k 5y agoIf you have a content-length header, and a checksum after the declared number of bytes, it becomes way harder to desync a request: prepended data would change the checksum, and an altered length header would make the parser miss the checksum in the stream.
- giantrobot 5y agoLower layer checksums will tell you the data made it across the wire correctly but have no idea if that data was correct in the context of the application layer. Keep in mind HTTP isn't only used between web browsers and servers. A client might use a HMAC to verify the content wasn't MITMed. Lower layer packet checksums won't do that and TLS won't necessarily prevent it either. Even when MITM isn't an issue HTTP can be proxied so a header checksum could verify a proxy didn't do something wrong.
- username223 5y ago> What’s great about HTTP 1.1 is it’s simplicity. This is an underappreciated feature of the old protocols. You can telnet into an HTTP, SMTP, POP, or even IMAP server and talk to it with your keyboard (using stunnel for the encrypted versions), or dump the traffic to learn the protocol or debug a problem. Good luck doing that with QUIC.
- bawolff 5y agoFor the second part, using wireshark is really not that big a jump in skill level and an easy way to debug the protocol (provided you get past the encryption)
- bitwize 5y agoMight want to try using tools from this century. We live in a post-curl, post-Wireshark world. There's no need to create excess waste heat parsing and unparsing "plain text" (lol, there is no such thing) protocols anymore; and anyways with SSL virtually mandatory it's not like it stays human readable over the wire. Fast, efficient, open binary protocols ftw!
- Cyph0n 5y agoTo me, the fact that it seems simple to roll your own HTTP 1.1 implementation is more of a downside than an advantage.
- ReactiveJelly 5y agoIn that sense, HTML also "runs the whole modern world". If you're talking about HTTP 1.1 and not thinking about the complexity of TLS, you're ignoring more than half the LoC in the stack. I like QUIC because I was never going to roll my own TLS anyway, so I might as well have TLS and streams in the same package.
- MayeulC 5y agoHTTP/1.1 is so simple that I can just open up netcat and ask a webpage from a website by hand. And this is not even my field. Now, you can also build a lot of complexity upon it. And while the simplicity is nice for inspecting and debugging sometimes, in practice it is rarely used, and it's a very complex beast with TLS, SSL, gzip compression and more. The arguments are similar to binary logs vs text logs. Except that in HTTP's case, it is already littered with binary.
- cogman10 5y agoThe case for "http is simple" similarly falls apart when you realize that a lot of tools for diagnosing http streams can just as easily (easier in fact) consume a binary stream and translate it into a human readable form as they can analyze the text form. We don't complain that we can't read our browser's binary but for some reason everyone is convinced that our transport protocols are different and it is imperative to be able to read it with a tool to translate it.
- throw10920 5y agoIt's not worth it to trade simplicity for performance or efficiency. Especially if the energy that is being wasted on simpler things is coming from fossil fuels.