4 ms·

Now compare the performance of HTTP/3 versus HTTP/1.1 over multiple years when the website isn't run by a corporation paying an engineer to babysit and maintain

Now compare the performance of HTTP/3 versus HTTP/1.1 over multiple years when the website isn't run by a corporation paying an engineer to babysit and maintain it. The HTTP/3 CA TLS HTTPS-only setup would start failing due to CA TLS problems eventually (in a year or two) while the HTTP/1.1 HTTP+HTTPS would remain accessible forever. This is the core problem with HTTP/3 for human people. It is one that could be fixed by developers if only the correct flags were set during compilation of the HTTP/3 libs and during their linking to the relevant browsers. But no one seems to care about human use cases. It's corporate security uber alles.

jsheard 2y ago
TLS-only servers needing babysitting is mostly a failing of older projects like nginx which leave certificate management as an exercise for the user - newer projects like Caddy and Traefik have shown that for simple deployments it can be made almost completely transparent with automatic ACME provisioning. Caddy can even gracefully handle cases where a certificate is unexpectedly revoked, by provisioning a new one immediately. It really does Just Work™.
- saurik 2y ago
  I don't know if it handles this unexpected-revocation scenario, but as Apache has had support for automated Let's Encrypt for a while now (I finally upgraded last week, when I realized I was missing out on this feature), I'm surprised that nginx doesn't?
  - __s 2y ago
    It does, just not out of the box https://certbot.eff.org/instructions?ws=nginx&os=arch https://certbot.eff.org/instructions?ws=nginx&os=arch
    - saurik 2y ago
      I don't know if I agree that this is "it does" as this isn't really "not out of the box" and kind of "fully external", but what I continue to be surprised by is that Apache DOES come with this functionality, "out of the box" (via a first-party module--and btw everything in Apache is built out of modules, including protocols--that ships with Apache and is configured inside of Apache), while nginx doesn't. I feel like the decision to use Apache has been vindicated throughout the ages, time and time again ;P. (There was a very short period of time when nginx was "faster", but not only did the world move on to ubiquitous CDNs anyway, but Apache quickly responded with mpm_event, which eventually became the default.)
  - uncanneyvalley 2y ago
    I believe they mean ACME provisioning and renewal isn't baked into nginx, i.e. you have to install certbot separately and run it daily from a cron job or systemd timer, whereas traefik and caddy handle this for you without additional software or configuration.
    - saurik 2y ago
      I understood that. As Apache does have a way for me to internally automate all of that, without using an external tool such as certbot, I am surprised that nginx doesn't as well. Either way, you should add Apache to your list of servers, along with caddy and traefik.
- superkuh 2y ago
  Newer indeed. Caddy isn't even 10 years old itself yet. I'm not sure how you can be sure it's all-in-one is going to handle long times gracefully. But for short term few to handful of years use cases, sure.
sebazzz 2y ago
> The HTTP/3 CA TLS HTTPS-only setup would start failing due to CA TLS problems eventually (in a year or two) Why? And why https with http 1.1 not?
acdha 2y ago
> The HTTP/3 CA TLS HTTPS-only setup would start failing due to CA TLS problems eventually (in a year or two) while the HTTP/1.1 HTTP+HTTPS would remain accessible forever This is nonsense: if you set up Let’s Encrypt or the equivalent, which is increasingly built in, it’ll keep working for HTTP 1-3. If you don’t, you need to rotate certificates for all of them. If your claim is that the HTTP 1 option is better because you can be insecure after the certificate expires, that’s conflating two separate things and saying that you don’t care about your users privacy and security, which might be true but is a more compelling argument against using that service than against HTTP/2.
- superkuh 2y ago
  I don't think you quite understood my point. Like said, HTTP+HTTPS in HTTP/3 would be perfect. Everyone could be happy and websites could have infinite unmaintained lifetimes and anyone could visit without getting approval from a third party corporation every 3 months. But nope, the big tech companies, and even Mozilla, refuse to implement an HTTP/3 that supports HTTP+HTTPS. It's flabberghasting, unless you view it through the lens of the needs of commerce only. That is my point. *re: This is nonsense: So when I set up lets encrypt using an acme (1) client it should still work today? Oh wait, they dropped acme 1 support entirely and only support acme 2 now (and will again with acme 3). And that's ignoring that whatever acme client you pick is going to have breaking changes too over time (even if it's acme.sh!). Then there's the 2018 LE root cert expiration... then the 2024 one, then there's TLS version sun-setting...). It is not so non-sensical down in the weeds of actually hosting a 90-day cert CA TLS website over more than a few years. And just to note: I love LE. I use LE for some websites. I think it's great. I love HTTPS too. I just think HTTPS-only instead of HTTP+HTTPS is very damaging socially.
  - acdha 2y ago
    Disagreement is not failure to understand. If you’re unable to rotate certificates on a decadal scale you aren’t in a position to run an internet-exposed service because anything will need at least some security updates over that kind of timeframe.
spintin 2y ago
This. The amount of times certificates have run out breaking things is astounding. So I work around all certificate test the first thing I do when integrating with an external HTTPS site. Good job people that get paid by HTTPS.

jsheard 2y ago

TLS-only servers needing babysitting is mostly a failing of older projects like nginx which leave certificate management as an exercise for the user - newer projects like Caddy and Traefik have shown that for simple deployments it can be made almost completely transparent with automatic ACME provisioning. Caddy can even gracefully handle cases where a certificate is unexpectedly revoked, by provisioning a new one immediately. It really does Just Work™.

saurik 2y ago
I don't know if it handles this unexpected-revocation scenario, but as Apache has had support for automated Let's Encrypt for a while now (I finally upgraded last week, when I realized I was missing out on this feature), I'm surprised that nginx doesn't?
- __s 2y ago
  It does, just not out of the box https://certbot.eff.org/instructions?ws=nginx&os=arch https://certbot.eff.org/instructions?ws=nginx&os=arch
  - saurik 2y ago
    I don't know if I agree that this is "it does" as this isn't really "not out of the box" and kind of "fully external", but what I continue to be surprised by is that Apache DOES come with this functionality, "out of the box" (via a first-party module--and btw everything in Apache is built out of modules, including protocols--that ships with Apache and is configured inside of Apache), while nginx doesn't. I feel like the decision to use Apache has been vindicated throughout the ages, time and time again ;P. (There was a very short period of time when nginx was "faster", but not only did the world move on to ubiquitous CDNs anyway, but Apache quickly responded with mpm_event, which eventually became the default.)
- uncanneyvalley 2y ago
  I believe they mean ACME provisioning and renewal isn't baked into nginx, i.e. you have to install certbot separately and run it daily from a cron job or systemd timer, whereas traefik and caddy handle this for you without additional software or configuration.
  - saurik 2y ago
    I understood that. As Apache does have a way for me to internally automate all of that, without using an external tool such as certbot, I am surprised that nginx doesn't as well. Either way, you should add Apache to your list of servers, along with caddy and traefik.
superkuh 2y ago
Newer indeed. Caddy isn't even 10 years old itself yet. I'm not sure how you can be sure it's all-in-one is going to handle long times gracefully. But for short term few to handful of years use cases, sure.

sebazzz 2y ago

> The HTTP/3 CA TLS HTTPS-only setup would start failing due to CA TLS problems eventually (in a year or two) Why? And why https with http 1.1 not?

acdha 2y ago

> The HTTP/3 CA TLS HTTPS-only setup would start failing due to CA TLS problems eventually (in a year or two) while the HTTP/1.1 HTTP+HTTPS would remain accessible forever This is nonsense: if you set up Let’s Encrypt or the equivalent, which is increasingly built in, it’ll keep working for HTTP 1-3. If you don’t, you need to rotate certificates for all of them. If your claim is that the HTTP 1 option is better because you can be insecure after the certificate expires, that’s conflating two separate things and saying that you don’t care about your users privacy and security, which might be true but is a more compelling argument against using that service than against HTTP/2.

superkuh 2y ago
I don't think you quite understood my point. Like said, HTTP+HTTPS in HTTP/3 would be perfect. Everyone could be happy and websites could have infinite unmaintained lifetimes and anyone could visit without getting approval from a third party corporation every 3 months. But nope, the big tech companies, and even Mozilla, refuse to implement an HTTP/3 that supports HTTP+HTTPS. It's flabberghasting, unless you view it through the lens of the needs of commerce only. That is my point. *re: This is nonsense: So when I set up lets encrypt using an acme (1) client it should still work today? Oh wait, they dropped acme 1 support entirely and only support acme 2 now (and will again with acme 3). And that's ignoring that whatever acme client you pick is going to have breaking changes too over time (even if it's acme.sh!). Then there's the 2018 LE root cert expiration... then the 2024 one, then there's TLS version sun-setting...). It is not so non-sensical down in the weeds of actually hosting a 90-day cert CA TLS website over more than a few years. And just to note: I love LE. I use LE for some websites. I think it's great. I love HTTPS too. I just think HTTPS-only instead of HTTP+HTTPS is very damaging socially.
- acdha 2y ago
  Disagreement is not failure to understand. If you’re unable to rotate certificates on a decadal scale you aren’t in a position to run an internet-exposed service because anything will need at least some security updates over that kind of timeframe.

spintin 2y ago

This. The amount of times certificates have run out breaking things is astounding. So I work around all certificate test the first thing I do when integrating with an external HTTPS site. Good job people that get paid by HTTPS.