Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTP/3 is everywhere but nowhere

httptoolkit.com

Post reply on HN
Print view View original

101–110 of 504 posts

Re: HTTP/3 is everywhere but nowhere

#101

Post by TheRealPomax »

lemagedurage wrote: post #71
ralferoo wrote: post #47

For me, I think the biggest issue with large scale deployment of HTTP 3 is that it increases the surface area of potentially vulnerable code that needs to be kept patched and maintained. I'd far rather have the OS provide a verified safe socket layer, and a dynamically linked SSL library, that can be easily updated without any of the application layer needing to worry about security bugs in the networking layer. Addi…

A "few extra ms" is up to 3 roundtrips difference, that's easily noticeable by humans on cellular. For all the CPU optimisations we're doing, cutting out a 50ms roundtrip for establishing a HTTP connection feels like a great area to optimize performance.

And yet, compared to the time you're waiting for that mast head jpeg to load, plus an even bigger "react app bundle", also completely irrelevant.

HTTP/3 makes a meaningful difference for machines that need to work with HTTP endpoints, which is what Google needed it for: it will save them (and any other web based system similar to theirs) tons of time and bandwidth, which at their scale directly translates to dollars saved. But it makes no overall difference to individual humans who are loading a web page or web app.

There's a good argument to be made about wasting round trips and HTTP/3 adoption fixing that, but it's not grounded in the human experience, because the human experience isn't going to notice it and go "...did something change? everything feels so much faster now".

Re: HTTP/3 is everywhere but nowhere

#102

Post by bjoli »

arccy wrote: post #96
hypeatei wrote: post #24

Earlier quoted context omitted.

> side note: sad that .NET and C# are not considered "major I've said it before on here, but the tech community severely underrates .NET today. It's not Windows only (and hasn't been for ~8 years) plus C# is a very nice language. F# is also an option for people who like functional languages. I'd highly recommend giving it a try if you haven't already.

It wasn't good enough for the typescript rewrite...

Mostly because they didnt consider the AOT compilation mature enough.

Re: HTTP/3 is everywhere but nowhere

#103

Post by the8472 »

lemagedurage wrote: post #71
ralferoo wrote: post #47

For me, I think the biggest issue with large scale deployment of HTTP 3 is that it increases the surface area of potentially vulnerable code that needs to be kept patched and maintained. I'd far rather have the OS provide a verified safe socket layer, and a dynamically linked SSL library, that can be easily updated without any of the application layer needing to worry about security bugs in the networking layer. Addi…

A "few extra ms" is up to 3 roundtrips difference, that's easily noticeable by humans on cellular. For all the CPU optimisations we're doing, cutting out a 50ms roundtrip for establishing a HTTP connection feels like a great area to optimize performance.

Isn't 5G supposed to solve the mobile latency issue?

Re: HTTP/3 is everywhere but nowhere

#104

Post by nine_k »

pas wrote: post #98
elcritch wrote: post #19

Earlier quoted context omitted.

IPv6 always seemed to me to be driven by a certain class of purist networking geeks. Then some corporations started getting on board like you said, but many couldn't care less.

wanting p2p to work (without quixotic NAT hole-punching) is puristry?

What good is your IPv6, Mr Anderson, if your upstream provider and/or middleboxes along the way do not support it?

Re: HTTP/3 is everywhere but nowhere

#105

Post by XorNot »

eptcyka wrote: post #77
cyanmagenta wrote: post #72

Earlier quoted context omitted.

> I'd far rather have the OS provide a verified safe socket layer There is work going on right now[1] to implement the QUIC protocol in the linux kernel, which gets used in userspace via standard socket() APIs like you would with TCP. Of course, who knows if it’ll ultimately get merged in. [1] https://github.com/lxin/quic

Yea, but does the kernel then also do certificate validation for you? Will you pin certs via setsockopt? I think QUIC and TLS are wide enough attack surfaces to warrant isolation from the kernel.

The problem is that the situation where everyone rolls their own certificate stack is lunacy in this day and age. We need crypto everywhere, and it should be a lot easier to configure how you want: the kernel is a great place to surface the common interface for say "what certificates am I trusting today?"

The 10+ different ways you specify a custom CA is a problem I can't wait to see the back of.

Re: HTTP/3 is everywhere but nowhere

#106

Post by CharlieDigital »

chronogram wrote: post #82
CharlieDigital wrote: post #61

Earlier quoted context omitted.

> Native AOT does not support cross-OS compilation > ...runtime-dependent and self-contained are fine This certainly reads like you moved the goal posts and recognized it.

The original question did ask about creating executables like Go, which means a single file you can run as is, so it was fair to mention AOT. For servers etc you usually don't want the AOT version, so then it doesn't matter which platform you develop on, but it's not always just like Go when you want to ship little applications.

The context of the thread is HTTP/3 servers; would it not make sense to take the comment in that context? Original article mentions that browsers (the client side) already supports HTTP/3 with the application server ecosystem being the missing piece.

Re: HTTP/3 is everywhere but nowhere

#107

Post by arccy »

hylaride wrote: post #45
nchmy wrote: post #14

Earlier quoted context omitted.

Could you elaborate on why faster responses don't benefit you or your users?

Because the faster response is negligible when you're an indie web host that can serve content over a single connection with reasonable speed. Where HTTP/3 really "shines" is when you connect to a web site that then has dozens of connections to other hosts (internal or external)...which is facebook/google/ad companies. HTTP/3 speeds up that kind of content by reducing connection startup times to all of them, which ca…

but it doesn't help for different external connections, each one needs a new connection.

it's good for multiple resources from the same host, maybe you have a lot of images on your photo blog or something

Re: HTTP/3 is everywhere but nowhere

#108

Post by SahAssar »

eptcyka wrote: post #77
cyanmagenta wrote: post #72

Earlier quoted context omitted.

> I'd far rather have the OS provide a verified safe socket layer There is work going on right now[1] to implement the QUIC protocol in the linux kernel, which gets used in userspace via standard socket() APIs like you would with TCP. Of course, who knows if it’ll ultimately get merged in. [1] https://github.com/lxin/quic

Yea, but does the kernel then also do certificate validation for you? Will you pin certs via setsockopt? I think QUIC and TLS are wide enough attack surfaces to warrant isolation from the kernel.

The kernel already does TLS, but the handshake happens in user-space.

Re: HTTP/3 is everywhere but nowhere

#109

Post by CharlieDigital »

shermantanktop wrote: post #84
hypeatei wrote: post #24

Earlier quoted context omitted.

> side note: sad that .NET and C# are not considered "major I've said it before on here, but the tech community severely underrates .NET today. It's not Windows only (and hasn't been for ~8 years) plus C# is a very nice language. F# is also an option for people who like functional languages. I'd highly recommend giving it a try if you haven't already.

.NET suffers from the long lasting reputational taint of Microsoft. It was seen as the sworn enemy of open source and Linux, and for good reason. Today’s MS is not what it was back then. But long memories are not a bad thing, really. If .NET suffers a bit from some unfair perception, perhaps that can remind MS and others what happens when you take an aggressively adversarial approach.

The ironic thing? GitHub, VS Code, and TypeScript are all Microsoft products.

Re: HTTP/3 is everywhere but nowhere

#110

Post by Sesse__ »

FuriouslyAdrift wrote: post #48
elcritch wrote: post #19

Earlier quoted context omitted.

IPv6 always seemed to me to be driven by a certain class of purist networking geeks. Then some corporations started getting on board like you said, but many couldn't care less.

The largest use of IPv6 is in mobile (cell) networks. When they effectively killed IP block mobility (provider independent netblocks), they (the standards bodies) effectively killed it's adoption everywhere else. I work in the networking space and outside of dealing with certain European subsidiaries, we don't use IPv6 anywhere. It's a pain to use and the IPv6 stacks on equipment (routers, firewalls, etc) are no wher…

What do you mean? IPv6 PI is common and easy to get; there's no big difference between IPv4 and IPv6 there.
Post reply on HN