Chrome Will Drop SPDY Support on May 15
techcrunch.com
techcrunch.com
The big problem with that is that currently no common server distributions provide an easy way to get OpenSSL 1.0.2. Many sites offer HTTP/2 with NPN instead of ALPN right now. Those will no longer get HTTP/2 in Chrome when SPDY and NPN are deprecated.
So, most web server administrators who do not want to deal with building their own OpenSSL/Nginx/... will have no choice but to drop SPDY and HTTP/2 completely, or switch to a future distro that comes with OpenSSL 1.0.2 (Ubuntu 16.04 will be the first major one in a few months).
The deprecation of NPN should, in my opinion, be postponed a little more. While you can easily upgrade your webserver with upstream packages, usually, switching to a different OpenSSL version is way out of scope for most administrators. Debian will have a stable release with OpenSSL 1.0.2 late 2016 or early 2017, CentOS 8 will probably take even longer. And even then, few people will just switch their server operating systems. Instead of pushing people to HTTP/2, deprecating NPN this soon will hurt adoption instead.
We've prepared for this problem too. Our SSL termination is handled on a completely independent server that basically just forwards requests to internal application servers, and it's completely stateless. This way we can just set up a new one on a less-stable distribution (we're experimenting with Debian Stretch) and switch once we find it stable enough to do just that. It means we can reap the benefits of possibly unstable HTTP/2 without affecting our stable application/storage stack.
The problem is imho the Linux distributions here. They should backport ALPN support if they decide to keep old openssl versions around.
According to https://blog.chromium.org/2016/02/transitioning-from-spdy-to..., "ALPN is already used 99% of the time to negotiate HTTP/2 with Chrome".
I think this shows their true colors in a sense. Chrome and SPDY exist purely to save Google bandwidth. They don't care about everyone else.
Chrome team in a nutshell
OS X 10.6, 10.7 and 10.8 are all being dropped and won't get security updates.
netmarketshare.com suggests that's about 13% of current OS X users.
It's especially irresponsible that "Chrome will continue to function on these platforms but will no longer receive updates and security fixes". They should be strongly encouraging those users to switch to a browser that's still supported on those platforms (which is probably only Firefox at this point).
Given Google's stance on autoupdating to be consistent they really should be pushing out a final update that prevents Chrome from running on those machines. A policy of "autoupdate till we don't care about you anymore" undermines the entire idea of automatically updating browsers.
That said, I think the question of how to serve these people is best left up to website operators and the people themselves.
A desktop with at least some 64bit Core2Duo is actually pretty fast if not even faster with Windows 10 instead of Windows 7 / Vista - 4GB is fine for office on such a machine.
The only caveat are these privacy and spy addons. I've yet to read some conclusive summary of these.
Now I'm a developer.
My mother on the other hand kept a Windows XP laptop running on a Celeron M processor and 1GB of memory. It felt snappy enough; but I wouldn't trust it to run Windows 10 applications because while Windows itself might dial down enough, something like Chrome will happily gobble 500GB of memory because it thinks it can.
Lack of vendor support can't be the reason for dropping these platforms - Chrome has continued to support XP and OS X 10.6 despite those being unsupported for years, and it's now dropping support for Vista while it's still supported by Microsoft.
Excepting for Vista, those are out of support from their vendor, so why should 3rd parities be obligated to support them?
I would hope that as a minimum they would show a very obvious alert to people on abandoned platforms warning them that the autoupdate agreement between user and browser vendor has been broken and that they need to find a new browser.
But I think they should go further. Google's logic for taking control over updates away from users is that it's too dangerous to let people continue to use old insecure versions of web browsers. If old browser versions are too dangerous to use then they should prevent Chrome from running on unsupported platforms since the only versions that will run on those platforms are by definition old insecure versions.
Google is a business. They decided to stop supporting a platform they don't think is relevant to their business anymore. There is no "moral" responsibility there besides looking at what's good for Google.
If users (customers) decided back then that they'd rather have free browsers and didn't support commercial (paid) alternatives they are now the only ones to blame for this happening. At this point the user can't even vote with their wallet now. They willingly gave away all their power for free stuff.
Clinging onto some "moral responsibility" is delusional. Now I get the allure of free stuff. But I also think many people blissfully ignore the fact that everything they do will have some form of consequences down the road and that there is no "free" stuff in life.
It's very disturbing that there are people in the tech industry who think that giving a product away for free absolves you of any moral responsibility.
As long as you're writing the checks to do so.
Only notable change is header compression. SPDY uses dynamic stream compression, HTTP/2 uses Huffman. And SPDY can be vulnerable to CRIME attack.