3 ms·
HTTP2 doesn't require encryption but it does compress the headers. I'm guessing compression makes it too CPU-intensive for telecoms to manipulate the headers o
by guelo 12y ago
HTTP2 doesn't require encryption but it does compress the headers. I'm guessing compression makes it too CPU-intensive for telecoms to manipulate the headers on the fly.
- TazeTSchnitzel 12y agoI wish they'd require encryption. Perhaps make http:// http:// be TLS but without certificate verification.
- kaoD 12y agoThen the telecoms would MITM it anyways.
- nitrogen 12y agoCertificate pinning and web-of-trust verification would make that difficult to maintain for long.
- kaoD 12y agoIt's unlikely they'll ever get mass usage because both are uncomfortable to work with. If a certificate is compromised, changing it means all pinned clients will get a huge warning. Either the user ignores the warning (in which case pinning is useless) or he doesn't and the site is harmed. Keeping a compromised certificate is even worse. For WoT you first need a web of trusted individuals. Unfortunately key distribution over insecure channels is still an unsolved problem.
- TD-Linux 12y agoThis is in progress. HTTP 2.0 does exactly what you specify. The tcpinc working group at the IETF is also looking at adding this at a lower level for all TCP connections.
- deleted 12y ago[deleted]
- TazeTSchnitzel 12y agoUh, they removed the TLS requirement.