8 ms·

HTTP/3 is becoming more popular because Microsoft and Google white-washed google's QUIC through the IETF. It's popular because what they call "HTTP/3" is perfec

HTTP/3 is becoming more popular because Microsoft and Google white-washed google's QUIC through the IETF. It's popular because what they call "HTTP/3" is perfectly designed for meeting the needs of a multi-national corporation serving web content to millions of people. But it's only megacorps using it for their walled gardens. It's a terrible protocol for the human person web. You can't even host a visitable website for people who use HTTP/3 without getting the permission of a third party corporation to temporarily lend you an TLS cert. Once Chrome drops HTTP/1.1 support say goodbye to just hosting a website as a person free from any chains to corporate ass-covering. While LetsEncrypt is benign now, it won't always stay that way as more and more people use it. Just like with dot Org it'll go bad and there'll be nowhere to run. TLS only HTTP/3 is just as bad for individual autonomy as web attestation in it's own way.

lost_tourist 3y ago
Can't you sign your own certificates? I honestly haven't done any work with http/3 so it's a sincere question.
- superkuh 3y ago
  I could. But that wouldn't help make my website visitable for anyone. I'm not trying to access my own hosted site. I want a random person on the other side of the world who I've never met and will never meet to be able to visit my website. That's the point of public websites. Generating my own root cert and using it does not help with this at all since no one else will have it installed nor install it unless I'm already good friends with them. Installing a root cert in the various trust stores is no simple task either. The easier self-sign with no root cert also doesn't help because every current implementation of HTTP/3 does not support self-signed certs.
  - lost_tourist 3y ago
    I mean you have to do that with https now if you don't go with one of the big guys? How is that any more dangerous to the end user than just going to an http site that they don't know personally? The risks are the same as far as malware.
    - superkuh 3y ago
      >How is that any more dangerous to the end user than just going to an http site that they don't know personally? Installing a random root cert to your trust store is a very dangerous thing to do but you're looking at this from the wrong end. I'm not talking about the dangers of a random user installing a random TLS root cert from me I send them over, what, email? That's just not going to happen. It shouldn't happen. I'm talking about the ability for human persons to host visitable websites without corporate oversight and control. With HTTP/1.1 I can just host a website from my IP and it's good. Anyone can visit. With HTTP/3 before anyone can visit my website I first have to go ask permission every ~90 days from a third party corporation. And if I piss them off (or people who put pressure on them in certain political regions), say by hosting a pdf copy of a scientific journal article, or a list of local abortion clinics, they can revoke my ability to host a visitable website. With HTTP/3, as a human person, the cure is worse than the "disease".
      - remexre 3y ago
        I think they meant, can't a visitor just ignore that your cert is self-signed and view the page anyway, _without_ adding it to the trust store. Firefox, at least, has this as the default "ignore the cert error" action.
        superkuh 3y ago
        Setting up a root cert in a trust store and accepting a non-root self-sign cert are very different things. That said, "can't a visitor just ignore that your cert is self-signed and view the page anyway," No. They cannot. Not when it's HTTP/3. Even if the browser ostensibly supports it the HTTP/3 connection will fail because the HTTP/3 lib Firefox uses does not allow it.
        paradite 3y ago
        Would that actually help your cause, since it would push people to build and distribute their own user agents which accepts self-signed certs/CA in a user-driven community without big corp oversight?
  - dark-star 3y ago
    Let's Encrypt and similar services will allow you to do exactly that though...?
- ta8645 3y ago
  Every visitor would have to manually trust them; provided they're using a browser that still allows them to do so.
  - kevincox 3y ago
    This is literally the same as HTTP except that browsers don't (by default yet) put up a scary warning for that. But with a self-signed cert you get protection from passive attackers and once you press yes the first time it verifies if someone else tries to hijack your connection. I think almost all protocols should have always-on encryption. You can choose to validate the other end or not but it is simpler and safer to only have the encrypted option in the protocol. FWIW I have HTTPS-only mode enabled and I would prefer to be notified of insecure connections. To me a self-signed cert is actually better than HTTP. I'm sure it will be a while until HTTPS-only is the default, but it seems clear that browsers are moving in that direction.
jezzamon 3y ago
If you want a domain name, it was never possible to host your own webpage without involving someone else who owns the domain/name server side of things
- pmlnr 3y ago
  But you don't need a domain name to host a webpage. It can be served over the IP address. You don't need a public IP either, a page can be for the local net. But indeed, if you want a traditional webpage that is accessible over the net and possible to remember it's URL, then yes, you need a domain, and for that, you need (at some level, even if you're a registrar) the entity who runs the tld.
  - paulddraper 3y ago
    Hosting a HTTP/3 page for local net..... I think we've gotten very theoretical
    - throwaway892238 3y ago
      If HTTP/1.1 is deprecated from all browsers, and HTTP/3 eventually becomes the only way to view a web page, then it will be impossible to host a localnet web page (ex. a wifi router). The people pushing this standard through don't make routers, so they don't give a shit, and everyone on the planet will just be screwed. This is what happens when we let 1 or 2 companies run the internet for us
      - paradite 3y ago
        Pardon my knowledge. If we are to get very technical instead of for average people, surely you can self-sign a cert and setup your CA chain on the computers in your local network? Or is there something else that prevents you from hosting HTTP/3 locally?
        jrmg 3y ago
        Knowing how to do that is quite a high barrier to entry.
aftbit 3y ago
This was an HTTP/2 issue as well. IMO it was a big miss to not specify some kind of non-signed mode with opportunistic encryption. That is, if you set up an HTTP/2 (or /3) connection to a server that did not have a signed cert, it would do an ECDH exchange and provide guarantees that nobody was passively snooping on the traffic. Of course this would not protect against an active MITM but would be better than falling back to pure plain text.
- KMag 3y ago
  Exactly. Unauthenticated encryption increases the costs of pervasive dragnet surveillance at a minimal cost/hassle.
dmazzoni 3y ago
You're against HTTP/3 because it makes security mandatory? Have you been completely asleep at the wheel over the past 20 years as ISPs around the world have started injecting ads in people's unencrypted HTTP traffic? That's great that you want to host a simple website that other people around the world can visit using simple HTTP. Maybe if your website is completely benign and harmless, that's not unreasonable. But a lot of us want to share information that's important, or sensitive - and we want sites where people can interact privately. I don't want the content of my site manipulated by third-parties along the way, and I don't want them snooping on traffic as people interact with my site.
- superkuh 3y ago
  Yes, because it's mandatory. If the HTTP/3 implementations allowed self-signed certs it'd be okay. But they don't. Or if HTTP/3 allowed the option of connections without TLS but defaulted to TLS, that'd be okay. But it doesn't.
  - afiori 3y ago
    > If the HTTP/3 implementations allowed self-signed certs Is it forbidden at the protocol level or by the implementations?
    - treesknees 3y ago
      It's an implementation limit that at least Chrome (and possibly other browsers) are enforcing for QUIC connections. The TLS certificate must be signed by a trusted CA. [1] There does appear to be cli flags to change the behavior, but I don't see how you'd do that on mobile or embedded browsers. [1]https://www.smashingmagazine.com/2021/09/http3-practical-deployment-options-part3/ https://www.smashingmagazine.com/2021/09/http3-practical-dep...
      - remram 3y ago
        You can add trusted CAs to your system though...
mardifoufs 3y ago
As opposed to decades of stonewalling and sluggish progress just because a few big corporations didn't want to have a harder to manage IT system? Literally most of the complaints against http3 are from corporate network engineers that now have a harder time controlling their networks. And more importantly, harder to implement mitm and monitoring. Which sure, that sucks for them but that's a massive upside for the vast majority of other internet users.
cptskippy 3y ago
> Once Chrome drops HTTP/1.1 support say goodbye to just hosting a website as a person free from any chains to corporate ass-covering. Is that even possible? It will effectively brick billions of consumer electronics that people have today (e.g. Routers, NAS Appliances, etc).
- josefx 3y ago
  what do you think happened when browsers killed java,silverlight and flash? Some of the hardware I have received a last minute firmware update to replace java applets with a minimal JavaScript fallback.
ReactiveJelly 3y ago
Your beef is with Google and the Chrome team, then. QUIC itself is a good protocol, and at the library level you can just tell it to trust any cert it sees. Google doesn't need to enable QUIC to disable self-signed certs in Chrome.
mgaunard 3y ago
it makes more sense than HTTP/2, which is retarded, but still widely adopted. It's incredible how many servers can't do pipelining when queried with HTTP/1, but do it fine with HTTP/2.
- kiitos 3y ago
  For someone who complains about web stuff so much, it's weird that you don't have a better understanding of the technology. No amount of pipelining can fix HTTP/1's request-per-connection model enough to make it competitive with HTTP/2.
  - mgaunard 3y ago
    I would say I have a pretty good understanding of Ethernet, IP, TCP, and also HTTP, having written implementations of that full stack several times -- including pretty sophisticated ultra-low-latency tricks. HTTP/2 implements multiplexing on top of TCP, which is just plain stupid. TCP is not meant to be used for this, and doing this is actively harmful; the correct thing to do is to establish multiple TCP connections. That sort of thing is not surprising since most of web and cloud tech is all about re-implementing low-level components on top of inadequate high-level abstractions. The main reason to use HTTP/2 is simply that when a server provides both 1 and 2, the backend quality will typically be much better on 2.
    - kiitos 3y ago
      Exhibit A > I would say I have a pretty good understanding of ... HTTP Exhibit B > HTTP/2 implements multiplexing on top of TCP, which is just plain stupid ... the correct thing to do is to establish multiple TCP connections
AuthorizedCust 3y ago
> It's a terrible protocol for the human person web. You can't even host a visitable website for people who use HTTP/3 without getting the permission of a third party corporation to temporarily lend you an TLS cert. Um, so many parts of web hosting require willing actions of corporations. Network, servers, etc. Why are you singling out just one part?
deleted 3y ago
[deleted]

lost_tourist 3y ago

Can't you sign your own certificates? I honestly haven't done any work with http/3 so it's a sincere question.

superkuh 3y ago
I could. But that wouldn't help make my website visitable for anyone. I'm not trying to access my own hosted site. I want a random person on the other side of the world who I've never met and will never meet to be able to visit my website. That's the point of public websites. Generating my own root cert and using it does not help with this at all since no one else will have it installed nor install it unless I'm already good friends with them. Installing a root cert in the various trust stores is no simple task either. The easier self-sign with no root cert also doesn't help because every current implementation of HTTP/3 does not support self-signed certs.
- lost_tourist 3y ago
  I mean you have to do that with https now if you don't go with one of the big guys? How is that any more dangerous to the end user than just going to an http site that they don't know personally? The risks are the same as far as malware.
  - superkuh 3y ago
    >How is that any more dangerous to the end user than just going to an http site that they don't know personally? Installing a random root cert to your trust store is a very dangerous thing to do but you're looking at this from the wrong end. I'm not talking about the dangers of a random user installing a random TLS root cert from me I send them over, what, email? That's just not going to happen. It shouldn't happen. I'm talking about the ability for human persons to host visitable websites without corporate oversight and control. With HTTP/1.1 I can just host a website from my IP and it's good. Anyone can visit. With HTTP/3 before anyone can visit my website I first have to go ask permission every ~90 days from a third party corporation. And if I piss them off (or people who put pressure on them in certain political regions), say by hosting a pdf copy of a scientific journal article, or a list of local abortion clinics, they can revoke my ability to host a visitable website. With HTTP/3, as a human person, the cure is worse than the "disease".
    - remexre 3y ago
      I think they meant, can't a visitor just ignore that your cert is self-signed and view the page anyway, _without_ adding it to the trust store. Firefox, at least, has this as the default "ignore the cert error" action.
      - superkuh 3y ago
        Setting up a root cert in a trust store and accepting a non-root self-sign cert are very different things. That said, "can't a visitor just ignore that your cert is self-signed and view the page anyway," No. They cannot. Not when it's HTTP/3. Even if the browser ostensibly supports it the HTTP/3 connection will fail because the HTTP/3 lib Firefox uses does not allow it.
        paradite 3y ago
        Would that actually help your cause, since it would push people to build and distribute their own user agents which accepts self-signed certs/CA in a user-driven community without big corp oversight?
- dark-star 3y ago
  Let's Encrypt and similar services will allow you to do exactly that though...?
ta8645 3y ago
Every visitor would have to manually trust them; provided they're using a browser that still allows them to do so.
- kevincox 3y ago
  This is literally the same as HTTP except that browsers don't (by default yet) put up a scary warning for that. But with a self-signed cert you get protection from passive attackers and once you press yes the first time it verifies if someone else tries to hijack your connection. I think almost all protocols should have always-on encryption. You can choose to validate the other end or not but it is simpler and safer to only have the encrypted option in the protocol. FWIW I have HTTPS-only mode enabled and I would prefer to be notified of insecure connections. To me a self-signed cert is actually better than HTTP. I'm sure it will be a while until HTTPS-only is the default, but it seems clear that browsers are moving in that direction.

jezzamon 3y ago

If you want a domain name, it was never possible to host your own webpage without involving someone else who owns the domain/name server side of things

pmlnr 3y ago
But you don't need a domain name to host a webpage. It can be served over the IP address. You don't need a public IP either, a page can be for the local net. But indeed, if you want a traditional webpage that is accessible over the net and possible to remember it's URL, then yes, you need a domain, and for that, you need (at some level, even if you're a registrar) the entity who runs the tld.
- paulddraper 3y ago
  Hosting a HTTP/3 page for local net..... I think we've gotten very theoretical
  - throwaway892238 3y ago
    If HTTP/1.1 is deprecated from all browsers, and HTTP/3 eventually becomes the only way to view a web page, then it will be impossible to host a localnet web page (ex. a wifi router). The people pushing this standard through don't make routers, so they don't give a shit, and everyone on the planet will just be screwed. This is what happens when we let 1 or 2 companies run the internet for us
    - paradite 3y ago
      Pardon my knowledge. If we are to get very technical instead of for average people, surely you can self-sign a cert and setup your CA chain on the computers in your local network? Or is there something else that prevents you from hosting HTTP/3 locally?
      - jrmg 3y ago
        Knowing how to do that is quite a high barrier to entry.

aftbit 3y ago

This was an HTTP/2 issue as well. IMO it was a big miss to not specify some kind of non-signed mode with opportunistic encryption. That is, if you set up an HTTP/2 (or /3) connection to a server that did not have a signed cert, it would do an ECDH exchange and provide guarantees that nobody was passively snooping on the traffic. Of course this would not protect against an active MITM but would be better than falling back to pure plain text.

KMag 3y ago
Exactly. Unauthenticated encryption increases the costs of pervasive dragnet surveillance at a minimal cost/hassle.

dmazzoni 3y ago

You're against HTTP/3 because it makes security mandatory? Have you been completely asleep at the wheel over the past 20 years as ISPs around the world have started injecting ads in people's unencrypted HTTP traffic? That's great that you want to host a simple website that other people around the world can visit using simple HTTP. Maybe if your website is completely benign and harmless, that's not unreasonable. But a lot of us want to share information that's important, or sensitive - and we want sites where people can interact privately. I don't want the content of my site manipulated by third-parties along the way, and I don't want them snooping on traffic as people interact with my site.

superkuh 3y ago
Yes, because it's mandatory. If the HTTP/3 implementations allowed self-signed certs it'd be okay. But they don't. Or if HTTP/3 allowed the option of connections without TLS but defaulted to TLS, that'd be okay. But it doesn't.
- afiori 3y ago
  > If the HTTP/3 implementations allowed self-signed certs Is it forbidden at the protocol level or by the implementations?
  - treesknees 3y ago
    It's an implementation limit that at least Chrome (and possibly other browsers) are enforcing for QUIC connections. The TLS certificate must be signed by a trusted CA. [1] There does appear to be cli flags to change the behavior, but I don't see how you'd do that on mobile or embedded browsers. [1]https://www.smashingmagazine.com/2021/09/http3-practical-deployment-options-part3/ https://www.smashingmagazine.com/2021/09/http3-practical-dep...
    - remram 3y ago
      You can add trusted CAs to your system though...

mardifoufs 3y ago

As opposed to decades of stonewalling and sluggish progress just because a few big corporations didn't want to have a harder to manage IT system? Literally most of the complaints against http3 are from corporate network engineers that now have a harder time controlling their networks. And more importantly, harder to implement mitm and monitoring. Which sure, that sucks for them but that's a massive upside for the vast majority of other internet users.

cptskippy 3y ago

> Once Chrome drops HTTP/1.1 support say goodbye to just hosting a website as a person free from any chains to corporate ass-covering. Is that even possible? It will effectively brick billions of consumer electronics that people have today (e.g. Routers, NAS Appliances, etc).

josefx 3y ago
what do you think happened when browsers killed java,silverlight and flash? Some of the hardware I have received a last minute firmware update to replace java applets with a minimal JavaScript fallback.

ReactiveJelly 3y ago

Your beef is with Google and the Chrome team, then. QUIC itself is a good protocol, and at the library level you can just tell it to trust any cert it sees. Google doesn't need to enable QUIC to disable self-signed certs in Chrome.

mgaunard 3y ago

it makes more sense than HTTP/2, which is retarded, but still widely adopted. It's incredible how many servers can't do pipelining when queried with HTTP/1, but do it fine with HTTP/2.

kiitos 3y ago
For someone who complains about web stuff so much, it's weird that you don't have a better understanding of the technology. No amount of pipelining can fix HTTP/1's request-per-connection model enough to make it competitive with HTTP/2.
- mgaunard 3y ago
  I would say I have a pretty good understanding of Ethernet, IP, TCP, and also HTTP, having written implementations of that full stack several times -- including pretty sophisticated ultra-low-latency tricks. HTTP/2 implements multiplexing on top of TCP, which is just plain stupid. TCP is not meant to be used for this, and doing this is actively harmful; the correct thing to do is to establish multiple TCP connections. That sort of thing is not surprising since most of web and cloud tech is all about re-implementing low-level components on top of inadequate high-level abstractions. The main reason to use HTTP/2 is simply that when a server provides both 1 and 2, the backend quality will typically be much better on 2.
  - kiitos 3y ago
    Exhibit A > I would say I have a pretty good understanding of ... HTTP Exhibit B > HTTP/2 implements multiplexing on top of TCP, which is just plain stupid ... the correct thing to do is to establish multiple TCP connections

AuthorizedCust 3y ago

> It's a terrible protocol for the human person web. You can't even host a visitable website for people who use HTTP/3 without getting the permission of a third party corporation to temporarily lend you an TLS cert. Um, so many parts of web hosting require willing actions of corporations. Network, servers, etc. Why are you singling out just one part?

deleted 3y ago

[deleted]