Live data from Hacker News

HTTP/3 is everywhere but nowhere

httptoolkit.com

31–40 of 504 posts

Re: HTTP/3 is everywhere but nowhere

#32

> You'll start to see lack of HTTP/3 support used as a signal to trigger captchas & CDN blocks, like as TLS fingerprinting is already today. HTTP/3 support could very quickly & easily become a way to detect many non-browser clients, cutting long-tail clients off from the modern web entirely. That explains it. I've seen this when using 3 year old browsers on retail web sites recently. A few cloud providers think I’m a…

It's horrible that the Internet is slowly becoming a locked-down ecosystem. Everyone should turn off HTTP/3 in protest of this. https://news.ycombinator.com/item?id=43329320

What exactly are sites supposed to do to prevent being the targets of DDoS, spam, fraud, aggressive bots, and other abuse? And it's not "locked down", it's usually just a CAPTCHA as long as you're not coming from an abusive IP range like might happen with a VPN.

Also there are a thousand other signals besides HTTP/3. It's not going to make a difference.

Re: HTTP/3 is everywhere but nowhere

#33

> You'll start to see lack of HTTP/3 support used as a signal to trigger captchas & CDN blocks, like as TLS fingerprinting is already today. HTTP/3 support could very quickly & easily become a way to detect many non-browser clients, cutting long-tail clients off from the modern web entirely. That explains it. I've seen this when using 3 year old browsers on retail web sites recently. A few cloud providers think I’m a…

I've been doing that on my hobby sites ever since all the popular browsers supported HTTP/2.0 [1]

    if ($server_protocol != HTTP/2.0) { return 444; }
It knocks out a lot of bots. I am thankful that most bots are poorly maintained and most botters are just skiddies that could not maintain the code if they wanted to.

[1] - https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#...

Re: HTTP/3 is everywhere but nowhere

#34
I'm using HAProxy on my 1 machine homelab. I'm not convinced that HTTP/3 a big improvement over HTTP/2, but for me, HTTP/3 was as easy as upgrading and adjusting the config file a little bit. From my perspective, the seeming lack of HTTP/3 support noted in this article is not a big problem. That said, I'm dying to get official 0-rtt support.

https://www.haproxy.org/

https://haproxy.debian.net/

https://www.haproxy.com/blog/announcing-haproxy-2-6

Live example: https://theandrewbailey.com/

Re: HTTP/3 is everywhere but nowhere

#35

> At the same time, neither QUIC nor HTTP/3 are included in the standard libraries of any major languages including Node.js, Go, Rust, Python or Ruby. .NET actually looking like it has decent support for any teams that are interested[0] (side note: sad that .NET and C# are not considered "major"...). There is an open source C library that they've published that seems rather far along[1] Support for Windows, Linux[2],…

> side note: sad that .NET and C# are not considered "major"...

Even Microsoft does not use C# for their new projects. See the new TypeScript compiler that is being rewritten in Go. So I think it is safe to say C# is indeed a minor language.

Re: HTTP/3 is everywhere but nowhere

#36
post #10

Every single project mentioned in the article is to some extent either open source and/or community driven. So nobody considered HTTP/3 interesting enough to rush and add support for it very quickly. It'll get there, but fast? I don't think so, see IPv6. Also, nobody considered HTTP/3 worth enough of paying for maintainers to add support for it.

99% of the benefit of HTTP/3 is on distributed web serving where clients are connecting to multiple remote ends on a web page (which lets be honest, is mostly used for serving ads faster).

Why would the open source community prioritize this?

Re: HTTP/3 is everywhere but nowhere

#37
post #5

How much does http/3 help for server to server traffic? Seems like larger websites can use a CDN or load balancer to do termination and then use http 1.1 to the back end. Is that good enough with large pipes and a high number of connections?

The primary benefits of QUIC apply in scenarios where you have some packet loss, and are multiplexing multiple independent "transactions" (DB queries, HTTP req's, gRPC calls etc.) over a single connection.

Multiplexing is very common but unless you are at megacorp scale (or operating a cloud hosting platform) packetloss within your own wired network infrastructure isn't a super common issue. Compared to say packetloss to mobile clients on bad networks where QUIC can really provide a significantly improved experience.

Re: HTTP/3 is everywhere but nowhere

#38

> At the same time, neither QUIC nor HTTP/3 are included in the standard libraries of any major languages including Node.js, Go, Rust, Python or Ruby. .NET actually looking like it has decent support for any teams that are interested[0] (side note: sad that .NET and C# are not considered "major"...). There is an open source C library that they've published that seems rather far along[1] Support for Windows, Linux[2],…

> side note: sad that .NET and C# are not considered "major"... Even Microsoft does not use C# for their new projects. See the new TypeScript compiler that is being rewritten in Go. So I think it is safe to say C# is indeed a minor language.

    > So I think it is safe to say C# is indeed a minor language
That's not really the case; StackOverflow survey[0] shows C# (27.1%) right behind Java (30.3%) and well ahead of Go (13.5%), Rust (12.6%), Kotlin (9.4%), Ruby (5.2%), and Scala (2.6%). If we exclude HTML/CSS, Bash/Shell, and SQL, C# would be #5 in actual languages used over the past year by devs in this survey.

You get the same result from scraping job postings: https://www.devjobsscanner.com/blog/top-8-most-demanded-prog...

    1. JS/TS (note these two are collapsed)
    2. Python
    3. Java
    4. C#
Two completely separate sources with the same output...

    > See the new TypeScript compiler that is being rewritten in Go
If they had started from scratch, Anders mentioned the considerations would be different. But because they had an existing body of code that was not class based, it would be more of a re-write (C#) versus a refactor (Go). A lot of folks read the headline without actually reading Anders' comments and reasoning.

C# is good for many things -- in particular application backends, game engines (both Godot and Unity) -- and not optimal for other things -- like serverless functions. Each language has a place and Go and Python are certainly better for CLI tools, for example.

[0] https://survey.stackoverflow.co/2024/technology

Post reply on HN