Lukasa

12 ms·

61.
by Lukasa 12y ago
HTTP/2 is redesigning the application layer protocol for the modern internet. QUIC is an attempt to redesign the transport layer. The two should work hand-in-hand. It'll be interesting to see how it works out!
62.
by Lukasa 12y ago
These are all really good points, let me just address one or two. > We are talking about ~300 bytes of data per header ... are the bandwidth gains really so superior to outweigh the CPU costs in having to compress the data? The commonly-
63.
by Lukasa 12y ago
This email reads like a tin-foil hat conspiracy theory. No evidence is provided for it, it's just a statement that some 'evil organisation' has forced an open organisation to do something the author didn't like. I should
64.
by Lukasa 12y ago
Notice that Amos was arguing for a happy-eyeballs approach, which removes the round trip. The issue isn't the wait for an extra round trip, it's making it mandatory to wait for an SRV result before using an A result. If the langua
65.
by Lukasa 12y ago
Correct, but you don't need the RFC to make SRV optional. If you'd like to use it, use it.
66.
by Lukasa 12y ago
> Why doesn't the HTTP/2 protocol use SRV DNS records? This was discussed by the WG. The best rationale is given in the thread starting from this mail[0] from Will Chan at Google, followed up by this one[1] from Amos Jeffries (
67.
by Lukasa 12y ago
Re building into Firefox: It absolutely could, and I'd love it if someone went ahead and did it. That would be a big coup for Mozilla and it simply can't be that hard to do. Hell, the Chrome guys could do it, mkcert is build on on
68.
by Lukasa 12y ago
Yes indeed, and you can do just that. The API server is open-source[1], and it's been Dockerized. Anyone who's really paranoid should absolutely run the server themselves. [1]: https://github.com/Lukasa/mkcert
69.
Show HN: A tool for creating custom TLS CA bundles(mkcert.org)
20 points by Lukasa 12y ago|7 comments
70.
by Lukasa 12y ago
The argument is that the two should be able to transparently interop together, and specifically that RFC 723[0-5] simply codifies the way HTTP/1.1 already works in the real world. We'll see how well that goes.
71.
by Lukasa 12y ago
Bug report opened on NewsBlur: https://github.com/samuelclay/NewsBlur/issues/534 Because they're using Requests this should be a fairly trivial fix for them.
72.
by Lukasa 12y ago
Yeah, we're not delighted about how complicated this is, but it's really the best we could do. =( To be clear though, Requests only requires the three packages be installed, it'll do everything else automatically. Actually, i
73.
by Lukasa 13y ago
Most languages now have a tool for writing and hosting documentation to make this as easy as possible for you. The author of the post runs http://readthedocs.org/ , which is primarily used by Python developers, for instance.
74.
by Lukasa 13y ago
This is not a new security hole. Carriers can do this today and transparently MITM all current HTTPS traffic: no new risk is present.
75.
by Lukasa 13y ago
That's a totally understandable fear. Personally, I trust the ability of user-agents to help users make informed decisions in this area, but I can understand why you don't. Nevertheless, even with this proposal HTTP/2.0 will
76.
by Lukasa 13y ago
As discussed yesterday, this is not a new MITM vulnerability. To make this work you need to establish a TLS connection to the proxy which is verified in the usual certificate authority way. Note that the standard says that user agents tha
77.
by Lukasa 13y ago
Both this article and that one were impressively alarmist. Speaking as someone who has implemented a HTTP/2.0 client stack it's really nothing like as bad as either of these articles makes out. For once, I invite you to fully read
78.
by Lukasa 13y ago
You're entirely right, and it's not just browsers. Your statement about 'user agents' was the better one. Consider also curl ( http://curl.haxx.se/docs/manpage.html#-L ) (and presumably libcurl), Pyth
79.
HTTP/2.0 for Python(lukasa.co.uk)
2 points by Lukasa 13y ago|0 comments
80.
by Lukasa 13y ago
The historical reason, as far as I can recall, is that it's an attempt to make the judiciary independent. If judges were elected, they'd have exactly the same biases as the other elected offices, which means they'd be a less
81.
Requests 2.0 Changelog Explained(lukasa.co.uk)
1 points by Lukasa 13y ago|0 comments
82.
by Lukasa 13y ago
Once again, thanks so much for that. Genuinely great work and we're so glad to have it.
83.
by Lukasa 13y ago
I wrote a blog post about implementing an IdP from scratch in Python. (Uses Django, but the lessons should be transferable). https://lukasa.co.uk/2013/04/Writing_A_Persona_Identity_Prov...
84.
by Lukasa 13y ago
As suggested above, this is probably because your browser doesn't trust StartSSL. If you don't want to add them to your trusted certs, the same page is available over HTTP as well as HTTPS.
85.
by Lukasa 13y ago
That seems likely. If you can't add StartSSL to your chain of trust, the same page can be accessed over HTTP instead of HTTPS.
86.
by Lukasa 13y ago
I can't reproduce this in Chrome or Firefox. Is this still happening for you?