Hypertext Transfer Protocol Version 2
tools.ietf.org
Hypertext Transfer Protocol Version 2
1–10 of 113 posts
Re: Hypertext Transfer Protocol Version 2
#2For context, this is the really-almost-final draft of HTTP/2. I would say speak now or forever hold your peace, but it's even too late for that.
Re: Hypertext Transfer Protocol Version 2
#3So TLS still isn't mandatory? Seems like a missed opportunity.
Re: Hypertext Transfer Protocol Version 2
#4So TLS still isn't mandatory? Seems like a missed opportunity.
I agree encryption is something that should be mandatory, but you can't pin down an encryption algo to be used by HTTP/2 without allowing for future changes..
Re: Hypertext Transfer Protocol Version 2
#5So TLS still isn't mandatory? Seems like a missed opportunity.
Mark Nottingham, who's chairing the working group, and has been at this stuff for a while, has a blog post about this: https://www.mnot.net/blog/2014/01/04/strengthening_http_a_pe...
Chrome and Firefox will still insist on TLS for HTTP/2. In addition, the HTTP/2 spec does mandate that any implementation must support TLS 1.2 and up, and it must support forward secret ciphersuites.
Re: Hypertext Transfer Protocol Version 2
#6There is so much open wifi nowadays that non-https should really start to be considered harmful. A large portion of website visitors are probably connecting via Starbucks, airport wifi, etc., which means their session cookies are basically public information.
So even given the mass surveillance problems, non-https connections need to start being treated as Bad Practice and discouraged by the sysadmin community.
Re: Hypertext Transfer Protocol Version 2
#7The best description of this protocol I have seen is "TCP over TCP."
Re: Hypertext Transfer Protocol Version 2
#8The best description of this protocol I have seen is "TCP over TCP."
I wonder if most of the mileage here could be gained by simply augmenting javascript's networking capabilities, enabling the use of non-HTTP servers (and keeping the HTTP protocol simple).
Re: Hypertext Transfer Protocol Version 2
#9The best description of this protocol I have seen is "TCP over TCP."
I wonder if most of the mileage here could be gained by simply augmenting javascript's networking capabilities, enabling the use of non-HTTP servers (and keeping the HTTP protocol simple).
I'm amused and depressed that the industry is willing to consider almost any solution -- except using something other than a web browser for tasks that do not involve browsing the web. Seriously... it works for Spotify, even now.
Re: Hypertext Transfer Protocol Version 2
#10To those saying HTTP2 should require HTTPS: do you really want to be stuck with our shitty CA model for even longer?