5 ms·

The article is basically a rant. I was hoping the author would go more into layer violation issues. Most of the interesting stuff from HTTP/2.0 comes from the

by zimbatm 12y ago

The article is basically a rant. I was hoping the author would go more into layer violation issues. Most of the interesting stuff from HTTP/2.0 comes from the better multiplexing of requests over a single TCP connection. It feels like we would have been better off removing multiplexing from HTTP altogether and then adopt SCTP instead of TCP for the lower transport. Or maybe he had other things in mind. > There are even people who are legally barred from having privacy of communication: children, prisoners, financial traders, CIA analysts and so on. This argument is quite weak, SSL can easily be MITMed if you control the host, generate custom certs and make all the traffic go trough your regulated proxy.

aidenn0 12y ago
In the early days of SPDY there was an article comparing SPDY to HTTP/1.1 over SCTP. The short version was other than the lack of header compression, it got nearly all the wins of SPDY, except: 1) Unless tunneled over UDP (which has its own problems) failed to work with NATs and stateful firewalls. 2) HTTP(s) only environments (e.g. some big corporations) would not work with it; SPDY will look enough like HTTPS to fool most of these. 3) Lack of Windows and OS X support for SCTP (without installing a 3rd party driver) means tunneling over UDP.
- worklogin 12y ago
  Yes, changing from TCP is about as difficult as changing from IPv4 - it would take years, and it would take a) catastrophic emergencies like IPv4's address exhaustion or b) completely passive, low-effort transitions/dual stack over years. Note that TCP processing is built into the hardware of all modern network ASICs from your PC to backbone routers and firewalls. Unfortunate, but true.
- gsnedders 12y ago
  What are the problems with SCTP over UDP, except the obvious extra (eight byte) overhead?
  - aidenn0 12y ago
    UDP is just not as reliable over NAT (mainly due to crappy NAT implementations). SCTP tries really hard to keep it working (including heartbeats on idle connections), but implementing the 50% of SCTP that HTTP benefits from over TCP will work exactly as well as HTTPS whereas SCTP over UDP runs into lots of tiny issues due to nobody having tested it on their $5 NAT before putting it in a wifi router or a DSL/CABLE modem.
ssalazar 12y ago
> SSL can easily be MITMed if you control the host How is it MITM if you control the host? If you don't trust the host then you are hosed, period- there is no protocol that will save you.
- rictic 12y ago
  You and the parent are not in disagreement. The point was merely that individuals who are subordinate (children, employees) can be monitored with or without TLS, and the original article's objection was irrelevant (and to my eyes, very strange).
  - phkamp 12y ago
    No, this is actually a very important point for me. If HTTP/2.0 had done this right, there wouldn't be a need for your employer to trojan your CA list so they can check for "inappropriate content" going either way through their firewall. (Under various laws they may be legally mandated to do so, flight controllers, financial traders etc.) But because HTTP/2.0 was more about $BIGSITEs unfettered access to their users, no mechanism was provided for such legally mandated M-I-T-M, and therefore the CA-system will be trojaned by even more people, resulting in even less security for these users. Likewise, pushing a lot of traffic which doesn't really need it onto SSL/TLS will only force NSA and others to trojan the CA-system even harder, otherwise they cannot do the job the law says they should do. As I've said earlier: Just mindlessly slapping encryption on traffic will not solve political problems but is likely to make them much worse. See for instance various "Law Enforcement" types calling for laws to ban encryption or Englands existing law that basically allow them to jail you until you decrypt whatever they want you to decrypt (never mind if you actually can or not...) Edit to add: The point about $BIGSITE is that everybody hates it when Hotels, ISPs and Phone companies modifies the content to insert adds etc. Rightfully so. Any proxy which does not faithfully pass content should be forced to need the clients accept for its actions. But since such proxies are legal and in some cases legally mandated some places (smut filters in libraries & schools, filters in jails. Parental controls at home, "compliance gateways" at companies) trying to make them impossible with the protocol just means that the protocol will be broken.

by zimbatm 12y ago

aidenn0 12y ago

In the early days of SPDY there was an article comparing SPDY to HTTP/1.1 over SCTP. The short version was other than the lack of header compression, it got nearly all the wins of SPDY, except: 1) Unless tunneled over UDP (which has its own problems) failed to work with NATs and stateful firewalls. 2) HTTP(s) only environments (e.g. some big corporations) would not work with it; SPDY will look enough like HTTPS to fool most of these. 3) Lack of Windows and OS X support for SCTP (without installing a 3rd party driver) means tunneling over UDP.

worklogin 12y ago
Yes, changing from TCP is about as difficult as changing from IPv4 - it would take years, and it would take a) catastrophic emergencies like IPv4's address exhaustion or b) completely passive, low-effort transitions/dual stack over years. Note that TCP processing is built into the hardware of all modern network ASICs from your PC to backbone routers and firewalls. Unfortunate, but true.
gsnedders 12y ago
What are the problems with SCTP over UDP, except the obvious extra (eight byte) overhead?
- aidenn0 12y ago
  UDP is just not as reliable over NAT (mainly due to crappy NAT implementations). SCTP tries really hard to keep it working (including heartbeats on idle connections), but implementing the 50% of SCTP that HTTP benefits from over TCP will work exactly as well as HTTPS whereas SCTP over UDP runs into lots of tiny issues due to nobody having tested it on their $5 NAT before putting it in a wifi router or a DSL/CABLE modem.

ssalazar 12y ago

> SSL can easily be MITMed if you control the host How is it MITM if you control the host? If you don't trust the host then you are hosed, period- there is no protocol that will save you.

rictic 12y ago
You and the parent are not in disagreement. The point was merely that individuals who are subordinate (children, employees) can be monitored with or without TLS, and the original article's objection was irrelevant (and to my eyes, very strange).
- phkamp 12y ago
  No, this is actually a very important point for me. If HTTP/2.0 had done this right, there wouldn't be a need for your employer to trojan your CA list so they can check for "inappropriate content" going either way through their firewall. (Under various laws they may be legally mandated to do so, flight controllers, financial traders etc.) But because HTTP/2.0 was more about $BIGSITEs unfettered access to their users, no mechanism was provided for such legally mandated M-I-T-M, and therefore the CA-system will be trojaned by even more people, resulting in even less security for these users. Likewise, pushing a lot of traffic which doesn't really need it onto SSL/TLS will only force NSA and others to trojan the CA-system even harder, otherwise they cannot do the job the law says they should do. As I've said earlier: Just mindlessly slapping encryption on traffic will not solve political problems but is likely to make them much worse. See for instance various "Law Enforcement" types calling for laws to ban encryption or Englands existing law that basically allow them to jail you until you decrypt whatever they want you to decrypt (never mind if you actually can or not...) Edit to add: The point about $BIGSITE is that everybody hates it when Hotels, ISPs and Phone companies modifies the content to insert adds etc. Rightfully so. Any proxy which does not faithfully pass content should be forced to need the clients accept for its actions. But since such proxies are legal and in some cases legally mandated some places (smut filters in libraries & schools, filters in jails. Parental controls at home, "compliance gateways" at companies) trying to make them impossible with the protocol just means that the protocol will be broken.