4 ms·

Ah yes, QUIC, the protocol that is infeasible to use to connect to people you don't know without getting continued approval from a corporate CA. Imagine if you

Ah yes, QUIC, the protocol that is infeasible to use to connect to people you don't know without getting continued approval from a corporate CA. Imagine if you couldn't use TCP without getting re-approved by a third party corporation every ~90 days. I suppose that's fine for corporate for-profit use but it makes things extremely brittle in both the technical and social senses.

conradludgate 3y ago
Can you elaborate on this? This doesn't seem like a fundamental issue with QUIC
- johncolanduoni 3y ago
  They’re probably referring to the fact that QUIC always performs TLS1.3 negotiation as part of its transport handshake, there’s simply no unencrypted version of it. However WebTransport actually supports providing a certificate hash at connection time on the client and ignoring the normal Web PKI altogether. But I doubt that will stop anyone who instinctively hates it because it came out of Google from continuing to do so.
  - conradludgate 3y ago
    Ah, I see. Well I use self signed TLS certificates just fine with QUIC. I also wouldn't log into a livestream without using a CA trusted TLS connection (unless you're ok on a free anonymous account with adverts I guess).
thedaly 3y ago
> the protocol that is infeasible to use to connect to people you don't know without getting continued approval from a corporate CA. What do you mean? Are you saying you can't serve content via QUIC with a certificate issued by lets say letsencrypt certbot?
- giantrobot 3y ago
  Self-signed certs in general are a pain in the ass with Chrome. It's only a matter of time before they're disallowed entirely. With QUIC requiring TLS self-signed certificates will only get more difficult to use if not impossible.
  - thedaly 3y ago
    You can use tools like certbot to get a working cert without "approval from a corporate CA". It isn't a selfsigned cert.
kixelated 3y ago
QUIC supports self-signed certs if LetsEncrypt is too corporate for you. WebTransport lets you specify the certificate fingerprint (sha256) much like WebRTC, although it does enforce that the certificate is valid for <14 days so it will need to be ephemeral.

conradludgate 3y ago

Can you elaborate on this? This doesn't seem like a fundamental issue with QUIC

johncolanduoni 3y ago
They’re probably referring to the fact that QUIC always performs TLS1.3 negotiation as part of its transport handshake, there’s simply no unencrypted version of it. However WebTransport actually supports providing a certificate hash at connection time on the client and ignoring the normal Web PKI altogether. But I doubt that will stop anyone who instinctively hates it because it came out of Google from continuing to do so.
- conradludgate 3y ago
  Ah, I see. Well I use self signed TLS certificates just fine with QUIC. I also wouldn't log into a livestream without using a CA trusted TLS connection (unless you're ok on a free anonymous account with adverts I guess).

thedaly 3y ago

> the protocol that is infeasible to use to connect to people you don't know without getting continued approval from a corporate CA. What do you mean? Are you saying you can't serve content via QUIC with a certificate issued by lets say letsencrypt certbot?

giantrobot 3y ago
Self-signed certs in general are a pain in the ass with Chrome. It's only a matter of time before they're disallowed entirely. With QUIC requiring TLS self-signed certificates will only get more difficult to use if not impossible.
- thedaly 3y ago
  You can use tools like certbot to get a working cert without "approval from a corporate CA". It isn't a selfsigned cert.

kixelated 3y ago

QUIC supports self-signed certs if LetsEncrypt is too corporate for you. WebTransport lets you specify the certificate fingerprint (sha256) much like WebRTC, although it does enforce that the certificate is valid for <14 days so it will need to be ephemeral.