Here is an example of how you can do this: https://github.com/tinspin/fuse
To use HTTPS, HTTP/2.0 or WebSockets is really not clever options when you can do secure, simple and more performant stuff in clear text over HTTP/1.1
Building Protocols with HTTP
51–55 of 55 posts
Re: Building Protocols with HTTP
#52Earlier quoted context omitted.
Building a protocol over HTTP has the added benefit of making security easy. HTTP+TLS has a lot more eyeballs than protocols on lower levels. Most protocols on layer 3 and below weren't designed with security as a priority. If you are building a domain specific protocol, it's a lot easier to build on top of one which already has a good security story backed by a triumvirate of internet unicorns, than trying to re-inv…
You only need TLS for that. HTTP adds nothing security-wise.
It adds Authorization, WWW-Authenticate, Proxy-Authentication, Proxy-Authenticate, Cache-Control, but those aren't even used that consistently.
Re: Building Protocols with HTTP
#53Earlier quoted context omitted.
Just curious, what do you think of QUIC? Seems like a layer 4 replacement, right?
QUIC operates on top of UDP, which would make it layer 5.
QUIC is the transport layer (layer 4).
> QUIC is an experimental transport layer network protocol [1]
You can run layer 4 on top of layer 4. (Just as you could say, run TCP layer 4 on top of HTTP layer 7.)
Re: Building Protocols with HTTP
#54Earlier quoted context omitted.
Still wrong. FTPS is vanilla FTP over TLS.
> Still wrong You know that thing that gives security practitioners a bad reputation with engineers? You're doing it. As opposed to this, why not something more like "it's not uncommon for these two to be confused, but FTPS is FTP over TLS and isn't interchangeable with SFTP"?
Because it's longer? Pardon my foreign mind, but I do not understand, why you are offended by a simple short and valid statement nor why you are differentiating between "security pratitioners" and "engineers".
Re: Building Protocols with HTTP
#55I can't say this trend surprises me. Years back I was an IETF meeting when people were already mentioning that the old saying "IP over everything, everything over IP" was slowly being phase out for "HTTP over everything, everything over HTTP". The thing to realize here is how much middleboxes sit between a client and a server, boxes which are aware of higher layers than just IP. It's impossible today to deploy an Int…
Just curious, what do you think of QUIC? Seems like a layer 4 replacement, right?
The fact that Google chose to build QUIC on top of UDP rather than on top of IP directly shows that not even Google think it's possible to introduce any new Layer 4 protocol.