3 ms·

It's a shame they dropped mandatory encryption. Now "HTTP2 all the things" doesn't mean "encrypt all the things" anymore.

Lukasa 12y ago
In practice it very nearly does. Only IE plan to support plaintext HTTP/2, all other browsers will only support it over TLS. Opportunistic Encryption is still on the table as well.
- byuu 12y ago
  The one major advantage to TLS everywhere will definitely be avoiding mixed-content issues when eg you have a web forum and someone tries to embed an image on a non-TLS server into their post. Hopefully IE's choice to be the one non-TLS HTTP/2 supporter doesn't undermine this. Since this is just going to be how it is, I just hope we can do more to make setting up TLS easier for everyone.
- higherpurpose 12y ago
  Ah, once again Microsoft is the one that supports less security than the other major companies. Microsoft needs to distance itself a bit more from law enforcement agencies.
  - Lukasa 12y ago
    I got the impression that Microsoft is backing this because of pressure from large enterprises, which do not want to deploy TLS in their intranets. I don't believe IE will prefer plaintext HTTP/2 to TLS HTTP/2, and it will certainly deploy both. Put another way: I don't believe Microsoft is worse than Google in this regard.
Nullabillity 12y ago
On the other hand, while "encrypt all the things" is a noble goal, the CA problem has to be sorted out first.
orthecreedence 12y ago
> It's a shame No, it's a blessing. Removing the ability to debug your HTTP calls while at the same time shoveling money into the pockets of sleazy CAs who are in the pocket of the NSA isn't going to help anyone. If we had a truly distributed, truly incorruptible CA system, I'd be all for shoving encryption down people's throats. As it is though, many things don't need encryption (such as any publicly-available informational site) and forcing people to use it by buying into a broken system doesn't make sense. Yes, people should be using more TLS. But it feels really, really wrong to force this in at the protocol level. Encryption is a transport concern, not a protocol one. I understand the purpose behind it, but it's the wrong solution.
- myhf 12y ago
  That's not a problem with encryption, it's a problem with the scary warning most browsers give about self-signed certificates.

Lukasa 12y ago

In practice it very nearly does. Only IE plan to support plaintext HTTP/2, all other browsers will only support it over TLS. Opportunistic Encryption is still on the table as well.

byuu 12y ago
The one major advantage to TLS everywhere will definitely be avoiding mixed-content issues when eg you have a web forum and someone tries to embed an image on a non-TLS server into their post. Hopefully IE's choice to be the one non-TLS HTTP/2 supporter doesn't undermine this. Since this is just going to be how it is, I just hope we can do more to make setting up TLS easier for everyone.
higherpurpose 12y ago
Ah, once again Microsoft is the one that supports less security than the other major companies. Microsoft needs to distance itself a bit more from law enforcement agencies.
- Lukasa 12y ago
  I got the impression that Microsoft is backing this because of pressure from large enterprises, which do not want to deploy TLS in their intranets. I don't believe IE will prefer plaintext HTTP/2 to TLS HTTP/2, and it will certainly deploy both. Put another way: I don't believe Microsoft is worse than Google in this regard.

Nullabillity 12y ago

On the other hand, while "encrypt all the things" is a noble goal, the CA problem has to be sorted out first.

orthecreedence 12y ago

> It's a shame No, it's a blessing. Removing the ability to debug your HTTP calls while at the same time shoveling money into the pockets of sleazy CAs who are in the pocket of the NSA isn't going to help anyone. If we had a truly distributed, truly incorruptible CA system, I'd be all for shoving encryption down people's throats. As it is though, many things don't need encryption (such as any publicly-available informational site) and forcing people to use it by buying into a broken system doesn't make sense. Yes, people should be using more TLS. But it feels really, really wrong to force this in at the protocol level. Encryption is a transport concern, not a protocol one. I understand the purpose behind it, but it's the wrong solution.

myhf 12y ago
That's not a problem with encryption, it's a problem with the scary warning most browsers give about self-signed certificates.