4 ms·
TLS termination is still not working for HTTP/3, I think. The nicest feature of HTTP/3 is that it is UDP based, and thus does not allow so much interception by
by aboardRat4 2y ago
TLS termination is still not working for HTTP/3, I think.
The nicest feature of HTTP/3 is that it is UDP based, and thus does not allow so much interception by the malicious ISPs.
- pas 2y agocan you please elaborate on what do you mean? TLS termination as in HTTP/3 on a reverse proxy? nginx's implementation works. (but for me it caused a strange performance degradation with Seafile)
- aboardRat4 2y agoHow exactly does it work? By terminating an udp stream and fetching the backend data using http 2.0? This might be enough for static web and such, but in a "new web" you'd want to use all those nice features of http/3 which have no direct equivalent in http/2, like multiplexing udp streams for video and such. And if you forward the udp stream itself, what do you do with the certificate? Use a selfsigned one with no expiration date and add a custom CA? Seems laborious.
- lokar 2y agoI think they mean these intercepting firewall/proxies that many big companies use to spy on their employees don’t work (yet)
- jeroenhd 2y agoThe people whose ISPs are spying on them, won't be able to use HTTP/3 anyway. It's not hard to figure out if a packet is HTTP/3 and when you drop all HTTP/3 packets your browser will usually just use something that does make it through.
- aboardRat4 2y agoWell, http/3 so far works in China and Russia, because, presumably, many enough required services are using it so that blocking indiscriminately is not practical.