TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

TLS in HTTP/2

93 点作者 bagder大约 10 年前

7 条评论

higherpurpose大约 10 年前
&gt; <i>Internet Explorer people have expressed that they intend to also support the new protocol without TLS, but when they shipped their first test version as part of the Windows 10 tech preview, that browser also only supported HTTP&#x2F;2 over TLS. As of this writing, there has been no browser released to the public that speaks clear text HTTP&#x2F;2. Most existing servers only speak HTTP&#x2F;2 over TLS.</i><p>I&#x27;m hoping it will stay this way. Defaults are important, so it&#x27;s the platforms&#x27; responsibility to support and enforce the &quot;safer&quot; options.<p>&gt; <i>The fact that it didn’t get in the spec as mandatory was because quite simply there was never a consensus that it was a good idea for the protocol. A large enough part of the working group’s participants spoke up against the notion of mandatory TLS for HTTP&#x2F;2. TLS was not mandatory before so the starting point was without mandatory TLS and we didn’t manage to get to another stand-point.</i><p>Which is interesting, because I remember quite clearly the &quot;Snowden discussion&quot; at the IETF, and there were consensus for an &quot;encrypt everything Internet&quot;.<p>&gt; <i>There is a claimed “need” to inspect or intercept HTTP traffic for various reasons. Prisons, schools, anti-virus, IPR-protection, local law requirements, whatever are mentioned.</i><p>Right. So IETF made it non-mandatory so law enforcement can get their &quot;master keys&quot; in a way. Also this &quot;anti-virus&quot; kind of protection, is basically what Superfish was. I&#x27;d rather that kind of behavior was stopped.<p>IETF would better start actually becoming useful and come up with ways to replace the CA system over the next few years, instead of taking protocols from others and ruining them as they standardize them. Otherwise we should rethink a new model for standardization if IETF is as useless&#x2F;malicious as it is right now.
评论 #9156486 未加载
评论 #9156233 未加载
评论 #9157000 未加载
blfr大约 10 年前
Even when only doing domain validations, CAs still usually ask for personal information. You would have to lie at least somewhat convincingly to obtain a certificate without providing personal details which feels fraudulent and could potentially put you at risk of having the certificate invalidated. I&#x27;m assuming let&#x27;s encrypt will address this since it&#x27;s going to be a fully automated(?) system.
m_eiman大约 10 年前
How could certificates ever work in embedded applications connected to consumer LANs that provide interfaces over HTTP? Aren&#x27;t certificates tied to IP addresses, which wouldn&#x27;t work with e.g. DHCP? Not to mention certificate expiration and updates…
评论 #9156973 未加载
评论 #9156476 未加载
评论 #9157483 未加载
评论 #9156471 未加载
comex大约 10 年前
The only one of the counterarguments that interests me is that it defeats caching. I mean, if 100 users in a large network want to access the same video or other large resource from the Internet, it seems pretty ridiculous that the connection must use 100 times as much bandwidth as it would if they could just install a simple caching proxy, especially if it&#x27;s just some cat video or online game, which is probably the common case. True, not all large resources are as innocent, and there is no real way around encrypting and not caching everything if you don&#x27;t want devices on the network to tell the difference... but the result is just so pathological. The price of freedom?<p>[For the record, YouTube seems to use HTTPS by default for video content, so this is already the case for some large percentage of the types of large resources typically accessed from shared networks.]
评论 #9158492 未加载
评论 #9160465 未加载
评论 #9158197 未加载
评论 #9158516 未加载
r1ch大约 10 年前
I still don&#x27;t see many arguments about advertising when it comes to TLS. I can&#x27;t deploy TLS across my sites without losing a huge amount of ad inventory due to cross-site request policies (no HTTP content from HTTPS domains).<p>AFAIK, Google is the only network actively working on having HTTPS-supported ads. The value of the ads drops significantly as the auction pressure from all the HTTP ads is gone, meaning any sites that rely on ad revenue can not afford to use TLS.
Nimi大约 10 年前
I&#x27;m surprised to see Certificate Transparency presented as a band-aid. My understanding is that assuming it will be deployed successfully, forged certificates will require very significant resources to use successfully for an attack, typically limiting such attacks to nation states.<p>But I would love to know where I&#x27;m wrong about this.
calibwam大约 10 年前
For how long will HTTP 1.1&#x2F;1.0 live alongside HTTP&#x2F;2? It&#x27;s all nice if every web page has TLS, but if I can just not upgrade to 2.0, it will not matter at all...
评论 #9156885 未加载