3 ms·

You know what http needs? Built in port location as part of the protocol... preferably via DNS.

by exabrial 4y ago

charcircuit 4y ago
SRV records already exist.
- M2Ys4U 4y ago
  Yes, but their use isn't defined for HTTP, and browsers don't support using SRV records for resolution.
  - charcircuit 4y ago
    A records aren't defined either.
    - M2Ys4U 4y ago
      Indeed, but the SRV resords spec states that they shouldn't be used where the protocol in question doesn't specify their use: "In general, it is expected that SRV records will be used by clients for applications where the relevant protocol specification indicates that clients should use the SRV record. Such specification MUST define the symbolic name to be used in the Service field of the SRV record as described below. It also MUST include security considerations. Service SRV records SHOULD NOT be used in the absence of such specification." -- RFC 2782
bawolff 4y ago
It really doesn't.
- inopinatus 4y ago
  It really does, but it also already has it via RFC7838 (HTTP Alternative Services / ALTSVC), which is normative for HTTP/3¹, albeit an optional client behaviour. Unfortunately not via DNS; you still have to run the origin on a well-known port if not specified in the URI. Clients supporting ALTSVC are then defined to use them at a requirement level of "should"². [1] https://datatracker.ietf.org/doc/html/rfc9114#section-3.1.1 https://datatracker.ietf.org/doc/html/rfc9114#section-3.1.1 [2] https://datatracker.ietf.org/doc/html/rfc7838#section-2.4 https://datatracker.ietf.org/doc/html/rfc7838#section-2.4
Gigachad 4y ago
What use cases are you thinking of? As far as I can see, the main and perhaps only use case is hosting websites behind ISPs which block the default ports. Although since http is leaving TCP, I wonder if these blocks will continue to work.
- asplake 4y ago
  Http to https (and maybe naked to www) upgrades specified in DNS instead of requiring redirects?
  - Gigachad 4y ago
    Don't we already have this problem solved via HSTS and particularly the preloaded list? Which is even more secure than doing it via DNS.
    - asplake 4y ago
      Only after an initial request
- inopinatus 4y ago
  One would be IP address assignment proliferation due to containers and shared services. SNI only goes part of the way to reducing the demand, being limited because it can't cross administrative trust boundaries. For v4 this is an ongoing exhaustion issue, but even for v6 it's an ops and allocation problem. Imagine if, for example, public clouds didn't need to burn a separate address for every dynamically provisioned load balancer.
stevekemp 4y ago
Do you mean something like the existing SRV records, or something else?
- billpg 4y ago
  Do web browsers look to SRV records with its port field in preference to A records?

You know what http needs? Built in port location as part of the protocol... preferably via DNS.

charcircuit 4y ago

SRV records already exist.

M2Ys4U 4y ago
Yes, but their use isn't defined for HTTP, and browsers don't support using SRV records for resolution.
- charcircuit 4y ago
  A records aren't defined either.
  - M2Ys4U 4y ago
    Indeed, but the SRV resords spec states that they shouldn't be used where the protocol in question doesn't specify their use: "In general, it is expected that SRV records will be used by clients for applications where the relevant protocol specification indicates that clients should use the SRV record. Such specification MUST define the symbolic name to be used in the Service field of the SRV record as described below. It also MUST include security considerations. Service SRV records SHOULD NOT be used in the absence of such specification." -- RFC 2782

bawolff 4y ago

It really doesn't.

inopinatus 4y ago
It really does, but it also already has it via RFC7838 (HTTP Alternative Services / ALTSVC), which is normative for HTTP/3¹, albeit an optional client behaviour. Unfortunately not via DNS; you still have to run the origin on a well-known port if not specified in the URI. Clients supporting ALTSVC are then defined to use them at a requirement level of "should"². [1] https://datatracker.ietf.org/doc/html/rfc9114#section-3.1.1 https://datatracker.ietf.org/doc/html/rfc9114#section-3.1.1 [2] https://datatracker.ietf.org/doc/html/rfc7838#section-2.4 https://datatracker.ietf.org/doc/html/rfc7838#section-2.4

Gigachad 4y ago

What use cases are you thinking of? As far as I can see, the main and perhaps only use case is hosting websites behind ISPs which block the default ports. Although since http is leaving TCP, I wonder if these blocks will continue to work.

asplake 4y ago
Http to https (and maybe naked to www) upgrades specified in DNS instead of requiring redirects?
- Gigachad 4y ago
  Don't we already have this problem solved via HSTS and particularly the preloaded list? Which is even more secure than doing it via DNS.
  - asplake 4y ago
    Only after an initial request
inopinatus 4y ago
One would be IP address assignment proliferation due to containers and shared services. SNI only goes part of the way to reducing the demand, being limited because it can't cross administrative trust boundaries. For v4 this is an ongoing exhaustion issue, but even for v6 it's an ops and allocation problem. Imagine if, for example, public clouds didn't need to burn a separate address for every dynamically provisioned load balancer.

stevekemp 4y ago

Do you mean something like the existing SRV records, or something else?

billpg 4y ago
Do web browsers look to SRV records with its port field in preference to A records?