4 ms·

HTTP over plaintext TCP is obsolete in a similar way to Telnet (vs SSH) or FTP (vs SFTP). It took something like 20 years for support for FTP to be dropped from

HTTP over plaintext TCP is obsolete in a similar way to Telnet (vs SSH) or FTP (vs SFTP). It took something like 20 years for support for FTP to be dropped from major user agents[0]. By the time the major browsers drop support for plaintext HTTP, that protocol will be as quaint and archaic as Gopher is today. (and we'll all be better off for it -- good riddance to anything ASCII-based or unauthenticated) [0] https://blog.mozilla.org/security/2021/07/20/stopping-ftp-support-in-firefox-90/ https://blog.mozilla.org/security/2021/07/20/stopping-ftp-su...

superkuh 4y ago
I think even you will be surprised how fast Google drops HTTP/1.1 support in Chrome. Humanity won't be better off for it but commerce certainly will. And I guess that's all that matters.
0x000xca0xfe 4y ago
HTTP/1.1 is not obsolete -- HTTP/2 and HTTP/3 preserve basically all semantics. HTTP/1 is better than 2 and 3 in many cases, e.g. when you cannot afford the complexity like in tiny embedded devices, or when you just need to bootstrap a WebSocket, or you don't need TLS. HTTP/1.1 will be obsolete when intranets and tiny devices are obsolete. Well, it looks like that could become true...
- deleted 4y ago
  [deleted]
skissane 4y ago
> HTTP over plaintext TCP is obsolete in a similar way to Telnet (vs SSH) or FTP (vs SFTP). That’s not comparing apples and oranges-HTTPS was originally just (and often still is just) plaintext HTTP/1.x wrapped in TLS. Whereas, SFTP and SSH are not FTP/TELNET over TLS, they are completely separate protocols. FTPS and TELNETS are the original protocols over TLS, but have seen only limited adoption (mostly in mainframe environments, in which SSH and SFTP perform poorly.) Even HTTP 2 and 3 are just a binary encoding of the HTTP/1.x protocol over an encrypted transport. By contrast, SSH and SFTP are essentially unrelated protocols to TELNET and FTP, as opposed to just binary encodings of them. (The TELNET protocol is already non-text-based anyway-the data may be mostly text but the control messages have never been.)
ahefner 4y ago
This take is really not crediting the different threat models motivating SSH versus HTTPS. In both cases the network is considered untrusted, but beyond this the analogy largely fails - almost every application of telnet risks leaking authentication credentials to an eavesdropper (in addition to allowing them to subsequently surveil your session), whereas the classical HTTP use case is to retrieve information anonymously. I cheered the widespread move toward HTTPS as a response to outrageous behavior by certain ISPs and their modifying/injecting content into sessions, which arguably should be criminalized, yet if the forces of abusive service providers and unaccountable state security agencies is becoming so omnipresent that we can only retreat beyond a veil of encryption, we are living in very dark times. I'd be more optimistic if not for the (cynical?) fear that those most in need of encryption will be the first to be denied it by the force of the state, a day only accelerated by its increasing ubiquity. Your government can force you to install a state-sanctioned CA cert, almost entirely undermining TLS from that perspective, which Google can/will do nothing to resist, and their parallel desire to deprecate plaintext HTTP is entirely orthogonal to this.

superkuh 4y ago

I think even you will be surprised how fast Google drops HTTP/1.1 support in Chrome. Humanity won't be better off for it but commerce certainly will. And I guess that's all that matters.

0x000xca0xfe 4y ago

HTTP/1.1 is not obsolete -- HTTP/2 and HTTP/3 preserve basically all semantics. HTTP/1 is better than 2 and 3 in many cases, e.g. when you cannot afford the complexity like in tiny embedded devices, or when you just need to bootstrap a WebSocket, or you don't need TLS. HTTP/1.1 will be obsolete when intranets and tiny devices are obsolete. Well, it looks like that could become true...

deleted 4y ago
[deleted]

skissane 4y ago

> HTTP over plaintext TCP is obsolete in a similar way to Telnet (vs SSH) or FTP (vs SFTP). That’s not comparing apples and oranges-HTTPS was originally just (and often still is just) plaintext HTTP/1.x wrapped in TLS. Whereas, SFTP and SSH are not FTP/TELNET over TLS, they are completely separate protocols. FTPS and TELNETS are the original protocols over TLS, but have seen only limited adoption (mostly in mainframe environments, in which SSH and SFTP perform poorly.) Even HTTP 2 and 3 are just a binary encoding of the HTTP/1.x protocol over an encrypted transport. By contrast, SSH and SFTP are essentially unrelated protocols to TELNET and FTP, as opposed to just binary encodings of them. (The TELNET protocol is already non-text-based anyway-the data may be mostly text but the control messages have never been.)

ahefner 4y ago

This take is really not crediting the different threat models motivating SSH versus HTTPS. In both cases the network is considered untrusted, but beyond this the analogy largely fails - almost every application of telnet risks leaking authentication credentials to an eavesdropper (in addition to allowing them to subsequently surveil your session), whereas the classical HTTP use case is to retrieve information anonymously. I cheered the widespread move toward HTTPS as a response to outrageous behavior by certain ISPs and their modifying/injecting content into sessions, which arguably should be criminalized, yet if the forces of abusive service providers and unaccountable state security agencies is becoming so omnipresent that we can only retreat beyond a veil of encryption, we are living in very dark times. I'd be more optimistic if not for the (cynical?) fear that those most in need of encryption will be the first to be denied it by the force of the state, a day only accelerated by its increasing ubiquity. Your government can force you to install a state-sanctioned CA cert, almost entirely undermining TLS from that perspective, which Google can/will do nothing to resist, and their parallel desire to deprecate plaintext HTTP is entirely orthogonal to this.