Varnish author criticizing HTTP/2.0 proposals • Hacker News Board

Re: Varnish author criticizing HTTP/2.0 proposals

#11

Post by comex » Tue, Jul 17, 2012, 2:39 AM UTC

MichaelGG wrote: post #10

comex wrote: post #3

Removing cookies from a protocol which is otherwise fully compatible with HTTP/1, in the sense of being able to be interposed as a proxy or substituted in the web server without breaking apps, is a terrible idea. > Cookies are, as the EU commision correctly noted, fundamentally flawed, because they store potentially sensitive information on whatever computer the user happens to use, and as a result of various abuses…

It doesn't seem like the proposals are "fully" compatible with HTTP. Some of them are entirely different encodings. And I doubt people are thinking of carrying over comments in headers and line folding... What actually is the proposal to eliminate cookies? Just provide some fixed "identifier" type field?

> And I doubt people are thinking of carrying over comments in headers and line folding...

Heh, I don't think any reasonable web apps actually depend on the value of those :)

> What actually is the proposal to eliminate cookies? Just provide some fixed "identifier" type field?

Unfortunately, I don't think there is a concrete proposal to compare to, other than

    Given how almost universal the "session" concept on the Internet we
    should add it to the HTTP/2.0 standard, and make it available for
    HTTP routers to use as a "flow-label" for routing.

Re: Varnish author criticizing HTTP/2.0 proposals

#12

Post by borlak » Tue, Jul 17, 2012, 2:41 AM UTC

load balancers aren't meant to just be "HTTP routers". they can definitely be used as such for smaller applications and do a good job at it, but a real load balancer needs to be quite complex, being able to adapt to the underlying applications that make use of it.

if your goal is to only route HTTP requests, then you're only solving the first step of an increasingly complicated field of computer science (namely, web applications).

Cookies aren't going to go away. if you want to improve the protocol to deal with cookies better, that makes sense, but acting like they are some kind of evil on the internet that should be forgotten isn't going to work. it's a bit self-defeating to argue that some protocols failed because of failure to provide new benefits and then argue against Cookies in HTTP!

Re: Varnish author criticizing HTTP/2.0 proposals

#13

Post by sukuriant » Tue, Jul 17, 2012, 2:45 AM UTC

patrickaljord wrote: post #5

> See for instance how SSH replaced TELNET, REXEC, RSH, SUPDUP > Or I might add, how HTTP replaced GOPHER[3]. telnet and gopher were used by a few thousands servers only and were not consumer facing technologies (for the most part), it doesn't make sense to compare that to IPv4 and HTTP that are used by millions (billion?) of servers.

Why not?

Re: Varnish author criticizing HTTP/2.0 proposals

#14

Post by bmelton » Tue, Jul 17, 2012, 2:57 AM UTC

patrickaljord wrote: post #5

> See for instance how SSH replaced TELNET, REXEC, RSH, SUPDUP > Or I might add, how HTTP replaced GOPHER[3]. telnet and gopher were used by a few thousands servers only and were not consumer facing technologies (for the most part), it doesn't make sense to compare that to IPv4 and HTTP that are used by millions (billion?) of servers.

Sukuriant's point might be terse, but it's not invalid either.

In 20 years' time, I'm pretty sure that the next iteration of us will be saying something like "When they phased out HTTP, there were only a few billion servers..."

Better will always make its way in, even if there are entrenched systems running the 'old faithful' code already out there. IE6 is being phased out, yes, VERY slowly, but we're already way closer to getting it down to an irrelevant number than we would be if there weren't pushes. Will we ever get rid of it completely? Maybe not. I'm sure there's still a gopher server out there somewhere or another, and it's not that uncommon to get Telnet access to some commodity (crappy) web hosts, but SSH is pervasive and good, and we're all better off for it.

Re: Varnish author criticizing HTTP/2.0 proposals

#15

Post by pdeuchler » Tue, Jul 17, 2012, 3:15 AM UTC

sciurus wrote: post #2

His proposal is at http://phk.freebsd.dk/misc/draft-kamp-httpbis-http-20-archit... It comes with the caveats that "Please disregard any strangeness in the boilerplate, I may not thrown all the right spells at xml2rfc, and also note that I have subsequently changed my mind on certain subjects, most notably Cookies which should simply be exterminated from HTTP/2.0, and replaced with a stable session/identity concept wh…

If I'm interpreting that correctly, that could be a huge win for privacy

Re: Varnish author criticizing HTTP/2.0 proposals

#16

Post by nl » Tue, Jul 17, 2012, 3:27 AM UTC

borlak wrote: post #12

load balancers aren't meant to just be "HTTP routers". they can definitely be used as such for smaller applications and do a good job at it, but a real load balancer needs to be quite complex, being able to adapt to the underlying applications that make use of it. if your goal is to only route HTTP requests, then you're only solving the first step of an increasingly complicated field of computer science (namely, web…

load balancers aren't meant to just be "HTTP routers". they can definitely be used as such for smaller applications and do a good job at it, but a real load balancer needs to be quite complex, being able to adapt to the underlying applications that make use of it

I think Poul-Henning Kamp is fairly well qualified to discuss what load balancers do.

(And yes, load balancer are fundamentally HTTP Routers. Yes, sometimes they do content manipulation etc, but all those features are add-ons to the basic use-case)

Re: Varnish author criticizing HTTP/2.0 proposals

#17

Post by pfraze » Tue, Jul 17, 2012, 3:29 AM UTC

MichaelGG wrote: post #10

comex wrote: post #3

Removing cookies from a protocol which is otherwise fully compatible with HTTP/1, in the sense of being able to be interposed as a proxy or substituted in the web server without breaking apps, is a terrible idea. > Cookies are, as the EU commision correctly noted, fundamentally flawed, because they store potentially sensitive information on whatever computer the user happens to use, and as a result of various abuses…

It doesn't seem like the proposals are "fully" compatible with HTTP. Some of them are entirely different encodings. And I doubt people are thinking of carrying over comments in headers and line folding... What actually is the proposal to eliminate cookies? Just provide some fixed "identifier" type field?

I'd say the cookies situation could be solved by one-page apps. Because the software persists across page-views, it'll be able to maintain session using some other mechanism (localstorage, the lifetime of the tab, whatever). The user could then disable cookies and not be worried about tracking.

Re: Varnish author criticizing HTTP/2.0 proposals

#18

Post by bickfordb » Tue, Jul 17, 2012, 3:43 AM UTC

borlak wrote: post #12

load balancers aren't meant to just be "HTTP routers". they can definitely be used as such for smaller applications and do a good job at it, but a real load balancer needs to be quite complex, being able to adapt to the underlying applications that make use of it. if your goal is to only route HTTP requests, then you're only solving the first step of an increasingly complicated field of computer science (namely, web…

Although I think he should further consider why many websites are using cookies at all or even cryptographically secure cookies, I think he makes a good point about caching and cookies. Websites with large amounts of traffic often move their static content to separate domains to avoid clients sending cookies headers on every request to static/forever-cacheable assets.

Re: Varnish author criticizing HTTP/2.0 proposals

#19

Post by quotemstr » Tue, Jul 17, 2012, 4:23 AM UTC

pdeuchler wrote: post #15

sciurus wrote: post #2

His proposal is at http://phk.freebsd.dk/misc/draft-kamp-httpbis-http-20-archit... It comes with the caveats that "Please disregard any strangeness in the boilerplate, I may not thrown all the right spells at xml2rfc, and also note that I have subsequently changed my mind on certain subjects, most notably Cookies which should simply be exterminated from HTTP/2.0, and replaced with a stable session/identity concept wh…

If I'm interpreting that correctly, that could be a huge win for privacy

How so? A unique identifier is a unique identifier.

Re: Varnish author criticizing HTTP/2.0 proposals

#20

Post by jfoutz » Tue, Jul 17, 2012, 4:23 AM UTC

patrickaljord wrote: post #5

> See for instance how SSH replaced TELNET, REXEC, RSH, SUPDUP > Or I might add, how HTTP replaced GOPHER[3]. telnet and gopher were used by a few thousands servers only and were not consumer facing technologies (for the most part), it doesn't make sense to compare that to IPv4 and HTTP that are used by millions (billion?) of servers.

Who won't support spdy by the end of the year? The pace of protocol obsolescence is increasing. I can't find stats about how much http traffic facebook is responsible for, but i'd bet it's at least 1%

Governments and home grown enterprise apps are my guess about who's late to the party.