Varnish author criticizing HTTP/2.0 proposals • Hacker News Board

Re: Varnish author criticizing HTTP/2.0 proposals

#131

Post by comex » Tue, Jul 17, 2012, 9:31 PM UTC

phkamp wrote: post #103

papsosouid wrote: post #100

Earlier quoted context omitted.

>Servers storing stuff on the clients is just plain wrong, and it is wrong from every single angle you can view it Not that it is surprising given the source, but this "my opinion is objectively correct" nonsense isn't constructive. Client side sessions give you stateless servers, which allows real seamless fail-over. Having to run a HA session-storage service to get that is a big additional cost. "PHK said it is rig…

They are not wrong because I say so, they are wrong because they are wrong. When it gets to the point where EU regulates something, the way they did with cookies, it should be painfully obvious to even the most casual observer, that there is something horribly wrong with it. As for the cost of your HA session-storage ? Cry me a river! You're the one making the money, you're the one who should carry the cost.

The EU did not start regulating cookies because your data could theoretically be leaked from your computer via cookies or something like that. They did it because cookies are used to track people, which is no different from a hypothetical session identifier, except that hypothetical browser controls could be added which are already fully possible with cookies.

Re: Varnish author criticizing HTTP/2.0 proposals

#132

Post by comex » Tue, Jul 17, 2012, 9:35 PM UTC

phkamp wrote: post #105

duckharp wrote: post #98

Earlier quoted context omitted.

Store the settings of anyone who ever connected? For how long? Forever, just in case? Silly. And why do you even assume the server has to have a database? Why should it be required to have one, why should it have to store the stuff? What is your take on statelessness? you concentrate so much on the abuses of cookies and client side storage/computation, but you're not addressing the advantages. I doubt you're aware of…

Uhm, isn't that how it works today ? Do you care about how many metric shitloads of storage your cookies take up on client's disks ? Shouldn't you ? Putting the cost of storage where the decision to store is made is sound economic practics.

My Cookies directory is 11 MB. That's actually quite a lot, considering the length of the average cookie, but my disk is 256 GB and it's only gotten that big because I've been browsing for years literally without ever clearing my cookies and I can clear them at any time.

This is really a non-issue.

Re: Varnish author criticizing HTTP/2.0 proposals

#133

Post by comex » Tue, Jul 17, 2012, 9:39 PM UTC

phkamp wrote: post #73

obtu wrote: post #68

Earlier quoted context omitted.

It may be counter-intuitive, but with the right cyphers, the crypto costs of SSL and SPDY are negligible.

No, they are not. For one thing you have to terminate all your SSL on your loadbalancer in order to distribute the traffic. That makes SPDY a no-go for web-hotels/web-hosting where each customer has their own certificate. Second, there are perfectly valid legally mandated circumstances which forbid end-to-end privacy, from children in schools to inmates in jail and patients in psych. hospitals, not to mention corpora…

> No, they are not. For one thing you have to terminate all your SSL on your loadbalancer in order to distribute the traffic. That makes SPDY a no-go for web-hotels/web-hosting where each customer has their own certificate.

That's what SNI is for.

> Second, there are perfectly valid legally mandated circumstances which forbid end-to-end privacy

Then install spyware on the user's computer, or add a trusted SSL key and mitm all the things.

Re: Varnish author criticizing HTTP/2.0 proposals

#134

Post by woobles » Wed, Jul 18, 2012, 12:31 AM UTC

romaniv wrote: post #120

rickmb wrote: post #61

After the whole IPv6 story, I'm surprised the author ignores the political dimension of designing a new protocol. As Mitch Kapor said "Architecture is Politics". It's not just about what solution is best from a technological perspective, it's about what we want our future to look like. The internet has become way more important than back when these protocols first became standard, and every time a protocol or standar…

Although I fully agree with the author's critique of cookies for instance, the idea of replacing them with something "better" frankly scares the crap out of me. Especially when the word "identity" is being used. Ever heard of evercookie? Does that not scare you? Would creating a clean, well-understood solutions that users can actually control not be better than what we have now? There is just so much wrong with cooki…

An evercookie is actually pretty straightforward to remove, if you know what you're doing with firebug/firecookie. The only tricky thing it does is persist a cookie in the sessionStorage of your window object, which isn't cleared when you clear your browser cache.

Re: Varnish author criticizing HTTP/2.0 proposals

#135

Post by pdeuchler » Wed, Jul 18, 2012, 2:36 AM UTC

quotemstr wrote: post #19

pdeuchler wrote: post #15

Earlier quoted context omitted.

If I'm interpreting that correctly, that could be a huge win for privacy

How so? A unique identifier is a unique identifier.

Of course, but the question is what that unique identifier denotes.

An IP address tells people who you are, where you are, and what you do.

A unique identifier ('+18El1iZRFCIiqRpfw4dJR8mXjJn2UxPrjwoRNpjSWg=' for instance) tells what you do without the who and where [1].

It's even possible advertisers could still target users based upon these identifiers, just without the background knowledge that makes these sorts of things privacy issues.

[1] I'll admit, it could be argued that the what can determine the who and where

Re: Varnish author criticizing HTTP/2.0 proposals

#136

Post by flyinRyan » Thu, Jul 19, 2012, 9:37 AM UTC

obtu wrote: post #83

rmc wrote: post #79

Earlier quoted context omitted.

Some of the concepts they tried to shove into IPv6 were downright evil, and would have killed the internet as we know it Oh? Got an example? I've never heard of this (but don't really follow IPv6 stuff).

The evil bit? I'm having a hard time coming up with something serious that would be enough to kill the internet as we know it.

I'm guessing the OP was talking about something that would make the internet less anonymous.

Re: Varnish author criticizing HTTP/2.0 proposals

#137

Post by pilif » Thu, Jul 19, 2012, 11:30 AM UTC

cbr wrote: post #116

pilif wrote: post #34

While in general I understand where he is coming from, I believe his main argument about adoption is flawed. What do you think is more likely going to be adopted? A protocol that's not backwards compatible at all (heck, it even throws out cookies) or something that works over the existing protocol, negotiating extended support and then switching to that while continuing to work the exact same way for both old clients…

> SNI issues aside What SNI issues? In practice any client that supports SPDY is going to support SNI.

Yes. But SPDY requires SSL, so in order to get any advantages of SPDY at all, you have to serve your site over SSL which requires one IP address per site due to the lack of SNI support in non-SPDY browsers.

So you either only provide SSL+SPDY for browsers you know support SNI, or you don't provide either SSL or SPDY to all of the browsers.

Re: Varnish author criticizing HTTP/2.0 proposals

#138

Post by tripzilch » Sat, Jul 21, 2012, 1:36 AM UTC

rickmb wrote: post #61

After the whole IPv6 story, I'm surprised the author ignores the political dimension of designing a new protocol. As Mitch Kapor said "Architecture is Politics". It's not just about what solution is best from a technological perspective, it's about what we want our future to look like. The internet has become way more important than back when these protocols first became standard, and every time a protocol or standar…

> Although I fully agree with the author's critique of cookies for instance, the idea of replacing them with something "better" frankly scares the crap out of me.

> Especially when the word "identity" is being used. You just know what kind of suggestions some powerful parties will come up with if you open this up for debate, and fighting that will take up all of the energy that should be put towards improving what we already have.

Oh wow, I hadn't thought of that. Reading that critique I was just thinking "oooh doing away with cookies would be a great thing", slightly wondering what one could replace it with ... but you're right, they'd probably replace it with something extra plus plus scary.