4 ms·

Do you really mean dropping HTTP? HTTP itself just requires an underlying reliable byte stream and does not dictate whether that is bare TCP, TLS, or any other

Do you really mean dropping HTTP? HTTP itself just requires an underlying reliable byte stream and does not dictate whether that is bare TCP, TLS, or any other concoction. Assuming you mean drop HTTP over bare TCP, and are advocating for HTTP over TLS, then everyone knows that is the right thing to aim for. But advocating revolution won't get anywhere since there is a phenomenal number of systems to update. Just like IPv6 deployment, it will take decades before HTTP over bare TCP is removed. The article is an excellent proposal because it helps migration. Certificates do need to be sorted out. Heck they currently hinge on names, yet what name does a random router bought at Best Buy and plugged into my network have? Or the armada of IOT devices coming along - thermostats, fridges, light bulbs?

IgorPartola 12y ago
You are technically correct (the best kind), but of course I mean dropping HTTP in favor of HTTPS. I don't think many people could possibly confuse what I meant. We all know the way this works and I don't want to get bogged down in semantics. I don't see anything there as constructive. I am advocation for a revolution. We have the technology today, and after Let's Encrypt goes live all we really need is for Google to announce that Chrome will run for six months with a warning when using HTTP (similar to what it does bow for self-signed certs) and the will stop supporting HTTP altogether. How quickly do you figure people will move if this was announced?
- rogerbinns 12y ago
  There is no way the scheme could possibly work. For example my printer is managed over HTTP. I'd have to keep two browsers around - the current (non-http supporting) version, and an older (insecure etc) version for all the things still using HTTP. I also don't see Netgear/Linksys/Dlink/Foscam doing firmware updates for all their devices out in the field, and even if they did they would require management over HTTP in order to transform them to TLS. Or in other words, you could cut off support for the major sites/devices using HTTP, but could never do it for everything in the next 6 months. Since you are advocating TLS support being mandatory, then it dropping HTTP for a different protocol is worth considering. HTTP/2 is a strong consideration, and currently is always over TLS.
  - IgorPartola 12y ago
    Perhaps browsers could include a "legacy mode" where stuff behind an IPv4 NAT could still be accessible over HTTP. This would of course require all manner of warnings. In general though, my router has a self-signed cert and works over HTTPS. I can even load my own cert. OpenWRT FTW.
    - rogerbinns 12y ago
      > This would of course require all manner of warnings Ok, now try and word one of those so that regular folk understand what the heck it is saying. And your "legacy mode" means HTTP is still supported. There is nothing wrong with deprecating HTTP over bare TCP, but being completely unsupported in the near future is unworkable. Everyone including this effort is about a slow steady migration.

IgorPartola 12y ago

You are technically correct (the best kind), but of course I mean dropping HTTP in favor of HTTPS. I don't think many people could possibly confuse what I meant. We all know the way this works and I don't want to get bogged down in semantics. I don't see anything there as constructive. I am advocation for a revolution. We have the technology today, and after Let's Encrypt goes live all we really need is for Google to announce that Chrome will run for six months with a warning when using HTTP (similar to what it does bow for self-signed certs) and the will stop supporting HTTP altogether. How quickly do you figure people will move if this was announced?

rogerbinns 12y ago
There is no way the scheme could possibly work. For example my printer is managed over HTTP. I'd have to keep two browsers around - the current (non-http supporting) version, and an older (insecure etc) version for all the things still using HTTP. I also don't see Netgear/Linksys/Dlink/Foscam doing firmware updates for all their devices out in the field, and even if they did they would require management over HTTP in order to transform them to TLS. Or in other words, you could cut off support for the major sites/devices using HTTP, but could never do it for everything in the next 6 months. Since you are advocating TLS support being mandatory, then it dropping HTTP for a different protocol is worth considering. HTTP/2 is a strong consideration, and currently is always over TLS.
- IgorPartola 12y ago
  Perhaps browsers could include a "legacy mode" where stuff behind an IPv4 NAT could still be accessible over HTTP. This would of course require all manner of warnings. In general though, my router has a self-signed cert and works over HTTPS. I can even load my own cert. OpenWRT FTW.
  - rogerbinns 12y ago
    > This would of course require all manner of warnings Ok, now try and word one of those so that regular folk understand what the heck it is saying. And your "legacy mode" means HTTP is still supported. There is nothing wrong with deprecating HTTP over bare TCP, but being completely unsupported in the near future is unworkable. Everyone including this effort is about a slow steady migration.