3 ms·
QUIC is very useful. It's basically the 50% of SCTP[1] needed for HTTP/3, with mandatory encryption and delivered over UDP so that middleboxes don't freak out
by aidenn0 3y ago
QUIC is very useful. It's basically the 50% of SCTP[1] needed for HTTP/3, with mandatory encryption and delivered over UDP so that middleboxes don't freak out over it.
1: Stream Control Transport Protocol https://en.wikipedia.org/wiki/Stream_Control_Transmission_Protocol https://en.wikipedia.org/wiki/Stream_Control_Transmission_Pr...
- o11c 3y agoNote that the actual SCTP is flawed in several ways, even ignoring the middlebox problem and tooling problems.
- remram 3y agoReference?
- throwawaaarrgh 3y agoI don't understand why anyone imagines "middleboxes" (there's an overloaded term) won't implement QUIC, drop connections that don't use their CA cert, and then fuck with the connection by mitm. ISPs might not in the west, but they sure as fuck will in less liberal societies, and every corporate network will eventually. The entire point of "middleboxes" is to solve a problem on a network you control. The problem doesn't go away "because encryption". They're just going to find another way to do what they want, because the protocol gods refuse to add needed features. Whoever decided that this was going to solve the problem didn't spend more than 5 minutes thinking about it. It's actually creating more problems.
- aidenn0 3y agoWell it definitely makes it so middleboxes are highly unlikely to misinterpret QUIC as anything pre-existing. Plenty of things will notice SCTP (whether or not encapsulated in UDP) and muck things up (or just drop everything).