Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Varnish author criticizing HTTP/2.0 proposals

lists.w3.org

Post reply on HN
Print view View original

81–90 of 138 posts

Re: Varnish author criticizing HTTP/2.0 proposals

#81

Post by g-garron »

rickmb wrote: post #61

After the whole IPv6 story, I'm surprised the author ignores the political dimension of designing a new protocol. As Mitch Kapor said "Architecture is Politics". It's not just about what solution is best from a technological perspective, it's about what we want our future to look like. The internet has become way more important than back when these protocols first became standard, and every time a protocol or standar…

There should be a way to "identify" yourself agains sites you are visiting. Which do not left tracks in you computer, so when you visit another site with a Facebook/Google "goodie" they cannot identify you again.

The problem is that cookies are in you computer, they should be ephemeral (you can do it, but is not standard).

But then, yes, Facebook and Google and even Governments will try to know everything about you.

Re: Varnish author criticizing HTTP/2.0 proposals

#82

Post by obtu »

phkamp wrote: post #73
obtu wrote: post #68

Earlier quoted context omitted.

It may be counter-intuitive, but with the right cyphers, the crypto costs of SSL and SPDY are negligible.

No, they are not. For one thing you have to terminate all your SSL on your loadbalancer in order to distribute the traffic. That makes SPDY a no-go for web-hotels/web-hosting where each customer has their own certificate. Second, there are perfectly valid legally mandated circumstances which forbid end-to-end privacy, from children in schools to inmates in jail and patients in psych. hospitals, not to mention corpora…

I was talking about performance, but: SNI addresses your first point. For the second point, whoever needs to enforce snooping already has to deal with SSL.

Re: Varnish author criticizing HTTP/2.0 proposals

#83

Post by obtu »

rmc wrote: post #79
rickmb wrote: post #61

After the whole IPv6 story, I'm surprised the author ignores the political dimension of designing a new protocol. As Mitch Kapor said "Architecture is Politics". It's not just about what solution is best from a technological perspective, it's about what we want our future to look like. The internet has become way more important than back when these protocols first became standard, and every time a protocol or standar…

Some of the concepts they tried to shove into IPv6 were downright evil, and would have killed the internet as we know it Oh? Got an example? I've never heard of this (but don't really follow IPv6 stuff).

The evil bit? I'm having a hard time coming up with something serious that would be enough to kill the internet as we know it.

Re: Varnish author criticizing HTTP/2.0 proposals

#84

Post by youngtaff »

nl wrote: post #16
borlak wrote: post #12

load balancers aren't meant to just be "HTTP routers". they can definitely be used as such for smaller applications and do a good job at it, but a real load balancer needs to be quite complex, being able to adapt to the underlying applications that make use of it. if your goal is to only route HTTP requests, then you're only solving the first step of an increasingly complicated field of computer science (namely, web…

load balancers aren't meant to just be "HTTP routers". they can definitely be used as such for smaller applications and do a good job at it, but a real load balancer needs to be quite complex, being able to adapt to the underlying applications that make use of it I think Poul-Henning Kamp is fairly well qualified to discuss what load balancers do. (And yes, load balancer are fundamentally HTTP Routers. Yes, sometimes…

Perhaps Kamp is qualified to discuss what some 'load-balancers' do...

The proxy developers have always had their doubts about SPDY (you can see them when @mnot first proposed it as a starting point)

Terminating SPDY at the HTTP Router makes a lot of sense architecturally but I know some orgs don't terminate SSL at the load-balancer due to the licensing costs.

Ultimately we need load-balancing options and someone to develop the opensource proxies (haproxy, varnish etc.) into more sophisticated offerings.

Perhaps they'll be a SPDY module for Traffic Server

Re: Varnish author criticizing HTTP/2.0 proposals

#85

Post by slig »

g-garron wrote: post #81
rickmb wrote: post #61

After the whole IPv6 story, I'm surprised the author ignores the political dimension of designing a new protocol. As Mitch Kapor said "Architecture is Politics". It's not just about what solution is best from a technological perspective, it's about what we want our future to look like. The internet has become way more important than back when these protocols first became standard, and every time a protocol or standar…

There should be a way to "identify" yourself agains sites you are visiting. Which do not left tracks in you computer, so when you visit another site with a Facebook/Google "goodie" they cannot identify you again. The problem is that cookies are in you computer, they should be ephemeral (you can do it, but is not standard). But then, yes, Facebook and Google and even Governments will try to know everything about you.

Cookies but blocking 3rd-party cookies solve that, doesn't?

Re: Varnish author criticizing HTTP/2.0 proposals

#86

Post by obtu »

phkamp wrote: post #70
obtu wrote: post #69

Earlier quoted context omitted.

The key difference with IPv6 is that SPDY is opaque to routers and only needs changes at the endpoints. IPv6 has the chicken-and-egg problem that it only becomes usable once everyone (hosters, ISPs, core networks, home networks, web frameworks, client devices) has deployed it, and most of those actors don't bother with things that bring no immediate benefit.

You do know that when IPv6 roll-out was initially contemplated, it would happen on IPv4-convertible addresses only, until everybody had converted. That would have allowed seamless IPv6/IPv4 interop and made migration a breeze. Lacking any "must have" features, nobody could see a reason to bother. Now we have to do the migration without the benefit of seamless conversion.

I regret missing out on that. Using those addresses? https://tools.ietf.org/html/rfc5156#section-2.3

That doesn't make the chicken-and-egg problem disappear. The best I could imagine is that it would allow IPv6 to downgrade to IPv4 using some sort of addition to the routing table. There's still no incentive to upgrade.

Re: Varnish author criticizing HTTP/2.0 proposals

#87

Post by eli »

vidarh wrote: post #74
angelbob wrote: post #53

Earlier quoted context omitted.

"Leakable" in the sense that you can hand it to somebody else and they can actually use it. A cookie is leakable because the client chooses to send it, so copying it to somebody else is really bad. A server-assigned per-connection ID is not leakable unless you can spoof the IP address of the one you're sending as.

Doing server side IP checks is already easy, but in reality it can lead to massive amounts of user complaints when their sessions keep disappearing, because as it turns out, some user segments have a lot of users coming through proxies where each request is not guaranteed to come from the same IP.

Or their mobile device roams from WiFi to cell data.

I suspect anyone suggesting that an IP be part of the session security has never actually tried it on a large scale.

Re: Varnish author criticizing HTTP/2.0 proposals

#88

Post by maggit »

rickmb wrote: post #61

After the whole IPv6 story, I'm surprised the author ignores the political dimension of designing a new protocol. As Mitch Kapor said "Architecture is Politics". It's not just about what solution is best from a technological perspective, it's about what we want our future to look like. The internet has become way more important than back when these protocols first became standard, and every time a protocol or standar…

You don't go to the author of Varnish for political advice, you go to the author of Varnish for technical advice. I'd be disappointed if he took advantage of his good name to push political advice when he got his reputation for being good at technical matters.

After all, is any of his technical advice invalid due to political concerns that are not wild speculation on your part?

----

Not to say that politics doesn't enter into it, just that it should be brought to the table and discussed by other actors. And those actors should probably be all ears about the technical issues.

Re: Varnish author criticizing HTTP/2.0 proposals

#89

Post by nl »

comex wrote: post #77
phkamp wrote: post #70

Earlier quoted context omitted.

You do know that when IPv6 roll-out was initially contemplated, it would happen on IPv4-convertible addresses only, until everybody had converted. That would have allowed seamless IPv6/IPv4 interop and made migration a breeze. Lacking any "must have" features, nobody could see a reason to bother. Now we have to do the migration without the benefit of seamless conversion.

Luckily, HTTP only requires the browser (which tend to be frequently updated) and server to be upgraded, not some random aging routers, there is little reason to fear adoption, there is minimal harm in keeping both protocols around for some time, and there is something much closer to a "must have" feature - speed.

Browsers are frequently updated only since Google moved the game on with Chrome auto-update.

Re: Varnish author criticizing HTTP/2.0 proposals

#90

Post by maggit »

neya wrote: post #75
rickmb wrote: post #61

After the whole IPv6 story, I'm surprised the author ignores the political dimension of designing a new protocol. As Mitch Kapor said "Architecture is Politics". It's not just about what solution is best from a technological perspective, it's about what we want our future to look like. The internet has become way more important than back when these protocols first became standard, and every time a protocol or standar…

This is a well thought, excellent comment that perfectly makes sense. Thank you. When huge corporations track you as how they are tracking you currently, most of the times, they don't get to know who you really are (except Facebook, because they know 'you'). That is, your identity. That's the only level of control you have over your anonymity. And these guys are proposing a new protocol just to remove that. Ridiculou…

I suspect you are reading too much into the word "identity". It is just a matter of identifying the endpoint, so the HTTP router can delegate requests from one user to the same backend instance in any given session. This, in turn, will give a user a consistent image of the state at the server independently of cache propagation in the backend. For example. You don't need the user's real life identity to do this, and you don't need the same identity across different sites or across different sessions.

This is currently sometimes done by cookies, which makes life difficult for HTTP routers. He is proposing a mechanism to keep the identifying-part while getting rid of problems in the HTTP router layer. The way I read this, it seemed to be without introducing additional privacy concerns and in fact removing some. (Cookies can carry more than identity)

There is a detailed technical discussion to be had about implementing all of this, and in this discussion any privacy concerns would become visible and open for discussion. But I think it is a leap to say that the comments in TFA would necessarily make for a world bereft of privacy ;)

Post reply on HN