Building Protocols with HTTP

Post by tzahola » Thu, Jul 19, 2018, 9:23 PM UTC

Immortalin wrote: post #13

heipei wrote: post #11

I can't say this trend surprises me. Years back I was an IETF meeting when people were already mentioning that the old saying "IP over everything, everything over IP" was slowly being phase out for "HTTP over everything, everything over HTTP". The thing to realize here is how much middleboxes sit between a client and a server, boxes which are aware of higher layers than just IP. It's impossible today to deploy an Int…

Building a protocol over HTTP has the added benefit of making security easy. HTTP+TLS has a lot more eyeballs than protocols on lower levels. Most protocols on layer 3 and below weren't designed with security as a priority. If you are building a domain specific protocol, it's a lot easier to build on top of one which already has a good security story backed by a triumvirate of internet unicorns, than trying to re-inv…

Post by tzahola » Thu, Jul 19, 2018, 9:26 PM UTC

paulddraper wrote: post #17

Immortalin wrote: post #13

Earlier quoted context omitted.

Building a protocol over HTTP has the added benefit of making security easy. HTTP+TLS has a lot more eyeballs than protocols on lower levels. Most protocols on layer 3 and below weren't designed with security as a priority. If you are building a domain specific protocol, it's a lot easier to build on top of one which already has a good security story backed by a triumvirate of internet unicorns, than trying to re-inv…

SSL/TLS with other protocols have a lot of usage too. SFTP/FTPS, SSH, SMTPS, etc.

Post by nineteen999 » Thu, Jul 19, 2018, 10:52 PM UTC

abricot wrote: post #5

sp4c3m0nk3y wrote: post #3

Earlier quoted context omitted.

I agree. What is wrong with creating new protocols?

Anything outside of port 80/443 will be blocked at some point.

Post by JoshTriplett » Thu, Jul 19, 2018, 11:12 PM UTC

Ajedi32 wrote: post #15

> Applications that use HTTP are encouraged to allow an arbitrary URL to be used as that entry point. For example, rather than specifying "the initial document is at "/foo/v1", they should allow a deployment to use any URL as the entry point for the application. Is this really saying that, for example, I shouldn't have an API specification that says "to fetch a list of users", send a GET to `/api/v3/users`? What's th…

Post by nineteen999 » Fri, Jul 20, 2018, 12:31 AM UTC

gsich wrote: post #28

nineteen999 wrote: post #25

Earlier quoted context omitted.

Blocked by who? Are you talking within some specific context, eg. corporate networks? Because HTTP/HTTPS are both TCP based protocols with some very limiting characteristics for many applications. There are a whole lot of applications out there in widespread use that depend on UDP at the very least, eg. most multiplayer network games, just to use the simplest and most common example I can think of. Not everything can…

Yes, the blocking problem mostly affects corporate networks or shady wlan access points. Game developers don't really have a problem with using UDP/TCP on random ports.