4 ms·

For one we’re limited to TCP and UDP– without a better protocol for media streaming . authentication was omitted , resulting in horrifying UX and security hole

For one we’re limited to TCP and UDP– without a better protocol for media streaming . authentication was omitted , resulting in horrifying UX and security holes and the omission of encryption led to sloppy tunneling solutions that are still being reworked 50 years later

Karrot_Kream 5y ago
> For one we’re limited to TCP and UDP– without a better protocol for media streaming . What's wrong with UDP for media? Is it the lack of multicast? > authentication was omitted , resulting in horrifying UX and security holes While this is painfully obvious now I don't think the original Internet pioneers have ever really thought of the need for authentication as the ubiquity and threat landscape was very different. Regardless, we're all paying the price now.
- tonymet 5y ago
  that’s like saying addresses are enough to deliver mail. there’s still flow control , error correction , buffering , authentication , stream multiplexing, compression, encoding etc etc streaming protocols handle this at the app layer but it would have been nice to have a protocol between reliable tcp and wild west udp
  - Karrot_Kream 5y ago
    I don't think most of these things should live at the Transport Layer personally. I am certainly a fan of SCTP but SCTP hasn't yet received widespread middlebox adoption. Unfortunately, the state of IP Media is pretty terrible. SIP/RTP/RTMP are all very complicated and fiddly to get working. The WebRTC stack, which wraps some of these protocols up, is its own beast. XMPP media stacks tend to be IMO the "simplest" and even they are quite complicated.
    - vvanders 5y ago
      As someone who's rolled a few custom UDP network stacks I would tend to agree. UDP is pretty low level(yay MTU discovery) but it gives you most of the tools you need which is why a good number of SCTP implementations are just built on top of it.
- kragen 5y ago
  UDP supports multicast
  - convolvatron 5y ago
    but the internet as a whole stopped a long time ago - is there still an MBONE?
    - jandrese 5y ago
      MBONE, now there is a name I have not heard in over 20 years.
      - dotancohen 5y ago
        You do know him then?
- convolvatron 5y ago
  that's not quite right. Bellovin et al in the late 80s early 90s really made a big push for authentication infrastructure (SPKI). but at the time PKI was being held hostage by ITAR (I remember sending off to get permission to use the RSA library, and getting something back several months later. so yes, many of the people working on these things didn't have a security mindset (I had unix accounts at all kinds of random places), but some did...and the US DoD really threw cold water on the whole business
  - Karrot_Kream 5y ago
    Interesting, thanks, I didn't know about this. I'll do some reading into SPKI. Do you know if these discussions are written down/chronicled somewhere?
    - TedDoesntTalk 5y ago
      He’s talking about late 80s , early 90s. Go back a few more years. Definitely before HTTP. FTP authentication was optional and I think sent in plain text or some really simple encryption (this is before SFTP). Telnet was used everywhere… plain text. And finger… really?
yardstick 5y ago
Authentication and encryption- I believe we would be in the same place we are today, with these responsibilities being delegated to the application layer, as the features of auth&enc changed faster than OS vendors are prepared to support. Eg how much longer would we have had to wait for ChaCha20-Poly1305 in web traffic if we had to wait for the major OS vendors to upgrade? And would they have backported this support to earlier OS versions? Probably not.

Karrot_Kream 5y ago

> For one we’re limited to TCP and UDP– without a better protocol for media streaming . What's wrong with UDP for media? Is it the lack of multicast? > authentication was omitted , resulting in horrifying UX and security holes While this is painfully obvious now I don't think the original Internet pioneers have ever really thought of the need for authentication as the ubiquity and threat landscape was very different. Regardless, we're all paying the price now.

tonymet 5y ago
that’s like saying addresses are enough to deliver mail. there’s still flow control , error correction , buffering , authentication , stream multiplexing, compression, encoding etc etc streaming protocols handle this at the app layer but it would have been nice to have a protocol between reliable tcp and wild west udp
- Karrot_Kream 5y ago
  I don't think most of these things should live at the Transport Layer personally. I am certainly a fan of SCTP but SCTP hasn't yet received widespread middlebox adoption. Unfortunately, the state of IP Media is pretty terrible. SIP/RTP/RTMP are all very complicated and fiddly to get working. The WebRTC stack, which wraps some of these protocols up, is its own beast. XMPP media stacks tend to be IMO the "simplest" and even they are quite complicated.
  - vvanders 5y ago
    As someone who's rolled a few custom UDP network stacks I would tend to agree. UDP is pretty low level(yay MTU discovery) but it gives you most of the tools you need which is why a good number of SCTP implementations are just built on top of it.
kragen 5y ago
UDP supports multicast
- convolvatron 5y ago
  but the internet as a whole stopped a long time ago - is there still an MBONE?
  - jandrese 5y ago
    MBONE, now there is a name I have not heard in over 20 years.
    - dotancohen 5y ago
      You do know him then?
convolvatron 5y ago
that's not quite right. Bellovin et al in the late 80s early 90s really made a big push for authentication infrastructure (SPKI). but at the time PKI was being held hostage by ITAR (I remember sending off to get permission to use the RSA library, and getting something back several months later. so yes, many of the people working on these things didn't have a security mindset (I had unix accounts at all kinds of random places), but some did...and the US DoD really threw cold water on the whole business
- Karrot_Kream 5y ago
  Interesting, thanks, I didn't know about this. I'll do some reading into SPKI. Do you know if these discussions are written down/chronicled somewhere?
  - TedDoesntTalk 5y ago
    He’s talking about late 80s , early 90s. Go back a few more years. Definitely before HTTP. FTP authentication was optional and I think sent in plain text or some really simple encryption (this is before SFTP). Telnet was used everywhere… plain text. And finger… really?

yardstick 5y ago

Authentication and encryption- I believe we would be in the same place we are today, with these responsibilities being delegated to the application layer, as the features of auth&enc changed faster than OS vendors are prepared to support. Eg how much longer would we have had to wait for ChaCha20-Poly1305 in web traffic if we had to wait for the major OS vendors to upgrade? And would they have backported this support to earlier OS versions? Probably not.