31–40 of 149 posts
> HTTP/1.1 is a delightfully simple protocol, if you ignore most of it. As someone who had to write a couple of proxy servers, I can't express how so sadly accurate it is.
I hope there's a h2 or TLS crash course.
Against my better judgement, the article /does/ go over H2 (although H3 is all the rage right now). For TLS, I recommend The Illustrated TLS 1.3 Connection (Every byte explained and reproduced): https://tls13.xargs.org/
> HTTP/1.1 is a delightfully simple protocol, if you ignore most of it. As someone who had to write a couple of proxy servers, I can't express how so sadly accurate it is.
And this is why I expect HTTP/2 and HTTP/3 to be much more robust in the long term: the implementations are harder to write, and you won’t get anywhere without reading at least a some spec, whereas HTTP/1 is deceptively simple with therefore a lot of badly incorrect implementations, often with corresponding security problems.
Earlier quoted context omitted.
And this is why I expect HTTP/2 and HTTP/3 to be much more robust in the long term: the implementations are harder to write, and you won’t get anywhere without reading at least a some spec, whereas HTTP/1 is deceptively simple with therefore a lot of badly incorrect implementations, often with corresponding security problems.
As someone who has not read the HTTP/1.1 spec, what are some pitfalls that could actually become security issues?
Earlier quoted context omitted.
And this is why I expect HTTP/2 and HTTP/3 to be much more robust in the long term: the implementations are harder to write, and you won’t get anywhere without reading at least a some spec, whereas HTTP/1 is deceptively simple with therefore a lot of badly incorrect implementations, often with corresponding security problems.
As someone who has not read the HTTP/1.1 spec, what are some pitfalls that could actually become security issues?
> HTTP/1.1 is a delightfully simple protocol, if you ignore most of it. As someone who had to write a couple of proxy servers, I can't express how so sadly accurate it is.
I learned HTTP1 pretty well but not much of 2. Since playing with QUIC, I've lost all interest in learning HTTP/2, it feels like something already outdated that we're collectively going to skip over soon.
FWIW HTTP/3 very much builds upon / reframes HTTP/2’s semantics, so it might be useful to get a handle on /2, as I’m not sure all the /3 documentation will frame it in /1.1 terms.
Is HTTP always the same protocol as HTTPS - given the same version - and ignoring the encryption from TLS? Theoretically yes, but in practice? I've done my share of nc testing even simpler protocols than HTTP/1.1 For some reason the migration to HTTPS scared me despite the security assurances. I could not see anything useful in wireshark anymore. I now had to trust one more layer of abstraction.
> Is HTTP always the same protocol as HTTPS - given the same version - and ignoring the encryption from TLS? > Theoretically yes, but in practice? Yes, that's the whole point of encapsulation . The protocol is blissfully unaware of encryption and doesn't even have to be. It has no STARTTLS mechanism either. Your HTTPS traffic consists of a TCP handshake to establishes a TCP connection, a TLS handshake across that TCP…
That was an excellent, well-written, well-thought out, well presented, interesting, humorous, enjoyable read. Coincidentally I recently did a Rust crash course so it all made perfect sense - I am not an IT pro. Anyhows, thanks.
I'd like to ask you what crash course on Rust did you take, as there are quite a few out there, and it would help if someone recommends a certain course.