3 ms·
> If HTTP/2.0 had done this right Is "right" in your opinion keeping SSL/TLS optional as it is today? Don't we already have the same concerns (legal obligation
by matt_kantor 12y ago
> If HTTP/2.0 had done this right
Is "right" in your opinion keeping SSL/TLS optional as it is today? Don't we already have the same concerns (legal obligation to MITM HTTPS connections)?
> no mechanism was provided for such legally mandated M-I-T-M
Maybe this is what you meant by doing it "right". How would this look? I'm having trouble imagining how such a mechanism could be securely built into HTTP.
- phkamp 12y agoIt's certainly not a trivial thing to design, but the "GET https://..." https://..." proposal floating around solves a lot of the relatively benign cases (company/school smut-proxies etc.) My point is that HTTP/2 didn't even try, because the political agenda for a lot of people were more or less "death to all client side proxies". They're entitled to that opinion of course, but given that laws in various countries say the exact opposite, the only thing they achieve by not making space for it in the security model is that the security model will be broken.