30 ms·
I don't think every connection is TLS. This is obviously a critical mistake, given HTTPS stripping is possibly the biggest weakness in current web transport se
by ctz 13y ago
I don't think every connection is TLS.
This is obviously a critical mistake, given HTTPS stripping is possibly the biggest weakness in current web transport security.
- deleted 13y ago[deleted]
- twoodfin 13y agoThere have been several debates about making TLS mandatory in HTTP 2.0 on the ietf-http-wg mailing list. Here's a link to a NetFlix engineer's comment in the most recent one I could find: http://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/0494.html http://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/... In short: While TLS is a really good idea for just about every user-facing site on the web, there are many applications where some combination of the administrative burden, need for intermediaries and performance cost make TLS sufficiently undesirable to preclude adoption of a spec that required it.