4 ms·

> If you can, require HTTP/2.0. Bots break. Non-bots break as well. I have Firefox configured to use HTTP/1.1 only. No reason to chase Google's standard-of-th

by gkbrk 4y ago

> If you can, require HTTP/2.0. Bots break. Non-bots break as well. I have Firefox configured to use HTTP/1.1 only. No reason to chase Google's standard-of-the-day, HTTP/1.1 has worked for ages and it will continue to do so for the foreseeable future.

sirshmooey 4y ago
Genuinely curious, why disable HTTP2? Your web browsing must be awfully slow sans multiplexing.
- gkbrk 4y ago
  > why disable HTTP2 Because it adds nothing to improve my browsing experience, and reducing the number of protocols supported by my browser from 3 to 1 also reduces the attack surface. > Your web browsing must be awfully slow sans multiplexing. And yet it's not slowed down at all. How many different resources must a web page use before it feels slow on a connection pool of keep-alive TCP sockets? Maybe people visit some wild experimental web pages with hundreds of blocking <src> tags that are not bundled/minified? Either way, my experience is it doesn't slow anything down when I use both websites (forums, resources, youtube, social media) and web apps (banking, maps, food delivery etc).
  - dboreham 4y ago
    Perhaps your experience is the same, but it may impose extra load on middleboxes that track TCP flows.
- stonemetal12 4y ago
  https://github.com/dalf/pyhttp-benchmark/blob/master/results/output.md https://github.com/dalf/pyhttp-benchmark/blob/master/results... HTTP2 is barely any better than http 1, if you want it to make a 1/10 of a second difference you have to be making 100s of requests.
Avamander 4y ago
Some old browsers break as well, if it's worth it depends on the website. It's your prerogative to disable an useful feature, you can also disable JavaScript. But there's little reason for a website operator to cater to that unnecessary edge case if it's mostly used for abuse.
- NullPrefix 4y ago
  JavaScript is mostly used for abuse.
  - Avamander 4y ago
    Not in that direction though.
bsuvc 4y ago
That seems like a strange reason to me. Isn't HTTP/2.0 faster? Isn't it also basically transparent to the end user? I'm trying to figure out what I would gain by configuring my browser to use HTTP/1.1 only.
dspillett 4y ago
If doing something fends off a lot of bots, but also inconveniences a very small number of people who have significantly non-standard or just out-of-date configurations, I'm likely to favour protecting myself from the former over worrying about the latter. To paraphrase Mr Spok: The inconveniences of the me outweigh the inconveniences of the you!
- b112 4y ago
  Bear in mind, inconveniencing 4.8% of users, does not map identically. Instead, you are often dumping 4.8+4.8+4.8 as you add block methods, with some overlap.
  - marginalia_nu 4y ago
    To be fair, most of my visitors are not exactly lining up with the expectations of "standard". I get >90% of my [human] traffic from desktop clients, for example.
    - b112 4y ago
      Sure, but the logic about mitigation does hold true, if you overlap methods. Eg, your method described in prior post, along with thongs which may lock out VPN or NAT users. Just something to consider.
  - dspillett 4y ago
    FWIW I don't block non-HTTP2, but at some point that 4.8% who can't use it will be much smaller and if you are still turning it off you will be part of an increasingly insignificant population. It is not dissimilar to measures that will have the side effect of stopping apps working on IE - I wouldn't in DayJob¹ but I'd not think twice on a personal project. I don't have time to care that much about people with very non-standard or very out-of-date setups, if accidentally blocking them is a side effect of a benefit I might feel. Added benefit: blocking them effectively removes potentially difficult users from the support queue! And to some, that 4.8%+4.8%+… doesn't overlap their target audience enough that losing the few in both categories isn't really a problem in the grand scheme of things. ---- [1] some of our clients still have users using IE11 even though we no longer officially support it² so we still don't want anything other than minor display & performance issues there ATM [2] of course we will for more money, if someone wants to pay us to address said minor display & performance issues

by gkbrk 4y ago

sirshmooey 4y ago

Genuinely curious, why disable HTTP2? Your web browsing must be awfully slow sans multiplexing.

gkbrk 4y ago
> why disable HTTP2 Because it adds nothing to improve my browsing experience, and reducing the number of protocols supported by my browser from 3 to 1 also reduces the attack surface. > Your web browsing must be awfully slow sans multiplexing. And yet it's not slowed down at all. How many different resources must a web page use before it feels slow on a connection pool of keep-alive TCP sockets? Maybe people visit some wild experimental web pages with hundreds of blocking <src> tags that are not bundled/minified? Either way, my experience is it doesn't slow anything down when I use both websites (forums, resources, youtube, social media) and web apps (banking, maps, food delivery etc).
- dboreham 4y ago
  Perhaps your experience is the same, but it may impose extra load on middleboxes that track TCP flows.
stonemetal12 4y ago
https://github.com/dalf/pyhttp-benchmark/blob/master/results/output.md https://github.com/dalf/pyhttp-benchmark/blob/master/results... HTTP2 is barely any better than http 1, if you want it to make a 1/10 of a second difference you have to be making 100s of requests.

Avamander 4y ago

Some old browsers break as well, if it's worth it depends on the website. It's your prerogative to disable an useful feature, you can also disable JavaScript. But there's little reason for a website operator to cater to that unnecessary edge case if it's mostly used for abuse.

NullPrefix 4y ago
JavaScript is mostly used for abuse.
- Avamander 4y ago
  Not in that direction though.

bsuvc 4y ago

That seems like a strange reason to me. Isn't HTTP/2.0 faster? Isn't it also basically transparent to the end user? I'm trying to figure out what I would gain by configuring my browser to use HTTP/1.1 only.

dspillett 4y ago

If doing something fends off a lot of bots, but also inconveniences a very small number of people who have significantly non-standard or just out-of-date configurations, I'm likely to favour protecting myself from the former over worrying about the latter. To paraphrase Mr Spok: The inconveniences of the me outweigh the inconveniences of the you!

b112 4y ago
Bear in mind, inconveniencing 4.8% of users, does not map identically. Instead, you are often dumping 4.8+4.8+4.8 as you add block methods, with some overlap.
- marginalia_nu 4y ago
  To be fair, most of my visitors are not exactly lining up with the expectations of "standard". I get >90% of my [human] traffic from desktop clients, for example.
  - b112 4y ago
    Sure, but the logic about mitigation does hold true, if you overlap methods. Eg, your method described in prior post, along with thongs which may lock out VPN or NAT users. Just something to consider.
- dspillett 4y ago
  FWIW I don't block non-HTTP2, but at some point that 4.8% who can't use it will be much smaller and if you are still turning it off you will be part of an increasingly insignificant population. It is not dissimilar to measures that will have the side effect of stopping apps working on IE - I wouldn't in DayJob¹ but I'd not think twice on a personal project. I don't have time to care that much about people with very non-standard or very out-of-date setups, if accidentally blocking them is a side effect of a benefit I might feel. Added benefit: blocking them effectively removes potentially difficult users from the support queue! And to some, that 4.8%+4.8%+… doesn't overlap their target audience enough that losing the few in both categories isn't really a problem in the grand scheme of things. ---- [1] some of our clients still have users using IE11 even though we no longer officially support it² so we still don't want anything other than minor display & performance issues there ATM [2] of course we will for more money, if someone wants to pay us to address said minor display & performance issues