4 ms·

I'm not convinced about the port stuff. Until support is well over 99%, using a custom port will mean your website is simply inaccessible to some visitors. Eve

by crote 3y ago

I'm not convinced about the port stuff. Until support is well over 99%, using a custom port will mean your website is simply inaccessible to some visitors. Even worse, a link which works perfectly fine on one computer will simply be completely broken on another, without any kind of warning or explanation. It's like trying to host a website on IPv6-only in 2023: nice idea, just not viable in practice. Besides, weren't the issues with SNI supposed to be solved with ESNI and Encrypted ClientHello?

teddyh 3y ago
Of course you have to maintain a backwards-compatible gateway proxy. But since most clients will not use it, and since it is obvious that it will be possible to remove it at some time in the future, this is, IMHO, acceptable. > Besides, weren't the issues with SNI supposed to be solved with ESNI and Encrypted ClientHello? Has that been implemented and/or standardized yet?
- DistractionRect 3y ago
  AFAIK that proposal got dropped in favor of ECH, which isn't standardized yet [0]. [0] https://blog.cloudflare.com/announcing-encrypted-client-hello/ https://blog.cloudflare.com/announcing-encrypted-client-hell...
  - btdmaster 3y ago
    Although it is not fully standardised, Firefox 119 and later should have it work [1]. It's now up to server implementations to get there as well. [1] https://defo.ie/ech-check.php https://defo.ie/ech-check.php
hlandau 3y ago
It seems to me this could also be an advantage for websites which want to make themself inaccessible in these circumstances. An enterprise which firewalls things so only port 443 is allowed out is also more likely to do corporate MitM of all traffic. Historically I was definitely annoyed that browsers chose to make custom root CAs an implicit exemption from HPKP (even if HPKP is now history). I'd certainly consider DoSing my own site under likely MitM conditions. Using a different port also makes it harder for organisations to successfully do this kind of filtering in the future if it becomes widespread. Another advantage is to prevent other kinds of blocking, which are based on blacklisting specific ports rather than only allowing port 443. Many residential ISPs and even hosting providers now engage in the flagrant net neutrality violation of blocking port 25; if use of SVCB records became common to allow a different port to be used, it would let other ports be used for site-to-site email, allowing email domains to contribute to rendering this blocking ineffective. Of course I'm not aware of any plan to adopt SVCB for email yet. But TBQH as someone who's always lamented the Internet's lack of a decent service lookup mechanism and the limitations (and lack of adoption) of SRV records, I'd like to see SVCB adopted for pretty much everything in future. Fundamentally the use of well known ports was always a mistake, and really was just a crutch which was entirely the product of the internet's lack of any real service discovery mechanism, aside from the late, extremely underused and very limited DNS SRV mechanism. Ports are a mere implementation/routing detail and should not have any semantic meaning whatsoever. The time when organisations can do port-based filtering is coming to an end, fortunately. (Even if they do continue with it, the ability to now move practically everything to port 443 makes it increasingly meaningless in terms of achieving whatever they thought they were hoping to achieve.)
vbezhenar 3y ago
> Until support is well over 99%, using a custom port will mean your website is simply inaccessible to some visitors. Even worse, a link which works perfectly fine on one computer will simply be completely broken on another, without any kind of warning or explanation. Welcome to my world. Some websites are blocked by my provider. Some websites are blocking my provider and inaccessible to me. And I'm not talking about something weird, things like w3c.com and istio.io were blocked at some periods of time for me. You want a working Internet? You need to use VPN. I don't think that anyone will evade that.
cmsj 3y ago
The RFC generally looks to be so substantially useful that I'd expect pretty swift adoption in platforms/browsers, so while the custom port thing may not be useful immediately, that will probably change within a few years (which is the blink of an eye in RFC time ;)
- j16sdiz 3y ago
  I am not that optimistic. HTTP have lots of embedded usage.
- teddyh 3y ago
  > I'd expect pretty swift adoption in platforms/browsers I am hopeful but sceptical. No browser implements it fully yet, AFAIK.

by crote 3y ago

teddyh 3y ago

Of course you have to maintain a backwards-compatible gateway proxy. But since most clients will not use it, and since it is obvious that it will be possible to remove it at some time in the future, this is, IMHO, acceptable. > Besides, weren't the issues with SNI supposed to be solved with ESNI and Encrypted ClientHello? Has that been implemented and/or standardized yet?

DistractionRect 3y ago
AFAIK that proposal got dropped in favor of ECH, which isn't standardized yet [0]. [0] https://blog.cloudflare.com/announcing-encrypted-client-hello/ https://blog.cloudflare.com/announcing-encrypted-client-hell...
- btdmaster 3y ago
  Although it is not fully standardised, Firefox 119 and later should have it work [1]. It's now up to server implementations to get there as well. [1] https://defo.ie/ech-check.php https://defo.ie/ech-check.php

hlandau 3y ago

It seems to me this could also be an advantage for websites which want to make themself inaccessible in these circumstances. An enterprise which firewalls things so only port 443 is allowed out is also more likely to do corporate MitM of all traffic. Historically I was definitely annoyed that browsers chose to make custom root CAs an implicit exemption from HPKP (even if HPKP is now history). I'd certainly consider DoSing my own site under likely MitM conditions. Using a different port also makes it harder for organisations to successfully do this kind of filtering in the future if it becomes widespread. Another advantage is to prevent other kinds of blocking, which are based on blacklisting specific ports rather than only allowing port 443. Many residential ISPs and even hosting providers now engage in the flagrant net neutrality violation of blocking port 25; if use of SVCB records became common to allow a different port to be used, it would let other ports be used for site-to-site email, allowing email domains to contribute to rendering this blocking ineffective. Of course I'm not aware of any plan to adopt SVCB for email yet. But TBQH as someone who's always lamented the Internet's lack of a decent service lookup mechanism and the limitations (and lack of adoption) of SRV records, I'd like to see SVCB adopted for pretty much everything in future. Fundamentally the use of well known ports was always a mistake, and really was just a crutch which was entirely the product of the internet's lack of any real service discovery mechanism, aside from the late, extremely underused and very limited DNS SRV mechanism. Ports are a mere implementation/routing detail and should not have any semantic meaning whatsoever. The time when organisations can do port-based filtering is coming to an end, fortunately. (Even if they do continue with it, the ability to now move practically everything to port 443 makes it increasingly meaningless in terms of achieving whatever they thought they were hoping to achieve.)

vbezhenar 3y ago

> Until support is well over 99%, using a custom port will mean your website is simply inaccessible to some visitors. Even worse, a link which works perfectly fine on one computer will simply be completely broken on another, without any kind of warning or explanation. Welcome to my world. Some websites are blocked by my provider. Some websites are blocking my provider and inaccessible to me. And I'm not talking about something weird, things like w3c.com and istio.io were blocked at some periods of time for me. You want a working Internet? You need to use VPN. I don't think that anyone will evade that.

cmsj 3y ago

The RFC generally looks to be so substantially useful that I'd expect pretty swift adoption in platforms/browsers, so while the custom port thing may not be useful immediately, that will probably change within a few years (which is the blink of an eye in RFC time ;)

j16sdiz 3y ago
I am not that optimistic. HTTP have lots of embedded usage.
teddyh 3y ago
> I'd expect pretty swift adoption in platforms/browsers I am hopeful but sceptical. No browser implements it fully yet, AFAIK.