There have been several debates about making TLS mandatory in HTTP 2.0 on the ietf-http-wg mailing list. Here's a link to a NetFlix engineer's comment in the mo

There have been several debates about making TLS mandatory in HTTP 2.0 on the ietf-http-wg mailing list. Here's a link to a NetFlix engineer's comment in the most recent one I could find: http://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/0494.html http://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/... In short: While TLS is a really good idea for just about every user-facing site on the web, there are many applications where some combination of the administrative burden, need for intermediaries and performance cost make TLS sufficiently undesirable to preclude adoption of a spec that required it.