3 ms·

> I think most stuff people do nowadays is things that's not cache-friendly anyway So you're OK with throwing away a perfectly fine and proven internet protoco

> I think most stuff people do nowadays is things that's not cache-friendly anyway So you're OK with throwing away a perfectly fine and proven internet protocol which has survived for several decades, on a vague notion you have that "it's probably not that cache-friendly anyway". That sounds solid. > HTTPS is not a security improvement for the hosts. So what? Reduced performance. Increased latency. Increased complexity. Increased attack-vector size. But indeed: so what? > HTTPS is frequently implemented improperly. Non-argument. Yes. Who cares about the real world, anyway? I'm awfully sorry, but I honestly don't think your post counts as a very good counter-argument to those very valid points which were raised in the reported issue.

maaaats 12y ago
> So you're OK with throwing away a perfectly fine and proven internet protocol which has survived for several decades, on a vague notion you have that "it's probably not that cache-friendly anyway". Don't do straw men, please. I said that it's not as big an issue as the author said it was. Nothing more, nothing less. > Reduced performance. Increased latency. Increased complexity. Increased attack-vector size. But indeed: so what? Not that much increased complexity in most cases. But the performance is a potentially good argument. The author should have used that instead.
hueving 12y ago
>So you're OK with throwing away a perfectly fine and proven internet protocol which has survived for several decades, on a vague notion you have that "it's probably not that cache-friendly anyway". HTTPS is not throwing away HTTP. It just protects it with TLS. >Increased attack-vector size. But indeed: so what? I think you meant 'decreased'. By not being able to modify the payloads or steal cookies, attackers are only left with the TLS protocol to try to mess with, which is a much smaller attack vector than being able to tweak HTTP headers and so-on.
- spacemanmatt 12y ago
  > I think you meant 'decreased'. It could have been a sideways glance at flaws in SSL/TLS that have rendered servers, data, or both compromised. Basically, a straw-man claim that plain text is actually more secure, since a flaw in the crypto stack could exist.
- rakoo 12y ago
  > HTTPS is not throwing away HTTP. It just protects it with TLS. Actually, in the issue that is linked the real problem is that HTTP is to be discarded in the government.
spacemanmatt 12y ago
Just how much cacheable content do you suppose lies in RESTful messages? I think you have significantly misunderstood the use case for REST. All that performance stuff you bring up applies to CDNs, but not API requests. It doesn't seem to me like you grasp the real world. There is a bit of a disparity between how we handle static content vs. dynamic API calls, and you demonstrate a willingness to conflate them repeatedly in this thread. It's baffling.

maaaats 12y ago

> So you're OK with throwing away a perfectly fine and proven internet protocol which has survived for several decades, on a vague notion you have that "it's probably not that cache-friendly anyway". Don't do straw men, please. I said that it's not as big an issue as the author said it was. Nothing more, nothing less. > Reduced performance. Increased latency. Increased complexity. Increased attack-vector size. But indeed: so what? Not that much increased complexity in most cases. But the performance is a potentially good argument. The author should have used that instead.

hueving 12y ago

>So you're OK with throwing away a perfectly fine and proven internet protocol which has survived for several decades, on a vague notion you have that "it's probably not that cache-friendly anyway". HTTPS is not throwing away HTTP. It just protects it with TLS. >Increased attack-vector size. But indeed: so what? I think you meant 'decreased'. By not being able to modify the payloads or steal cookies, attackers are only left with the TLS protocol to try to mess with, which is a much smaller attack vector than being able to tweak HTTP headers and so-on.

spacemanmatt 12y ago
> I think you meant 'decreased'. It could have been a sideways glance at flaws in SSL/TLS that have rendered servers, data, or both compromised. Basically, a straw-man claim that plain text is actually more secure, since a flaw in the crypto stack could exist.
rakoo 12y ago
> HTTPS is not throwing away HTTP. It just protects it with TLS. Actually, in the issue that is linked the real problem is that HTTP is to be discarded in the government.

spacemanmatt 12y ago

Just how much cacheable content do you suppose lies in RESTful messages? I think you have significantly misunderstood the use case for REST. All that performance stuff you bring up applies to CDNs, but not API requests. It doesn't seem to me like you grasp the real world. There is a bit of a disparity between how we handle static content vs. dynamic API calls, and you demonstrate a willingness to conflate them repeatedly in this thread. It's baffling.