HTTP/3: the past, the present, and the future
blog.cloudflare.com
blog.cloudflare.com
alt-svc: h3-22=":443"; ma=86400
$ curl -vs https://blog.cloudflare.com/ 2>&1 | grep alt-svc
< alt-svc: h3-23=":443"; ma=86400
Sure there are good things about it, and many great enhancements, but the larger mechanic of the protocol (the most important part really) has been significantly worsened. I'd rate them as follows:
HTTP3 > HTTP1.1 > HTTP2
QUIC is an amazing protocol, I have no complaints about it, and I'm very happy they decided to go with it for HTTP3. However the decision to make HTTP2 traffic go all through a single TCP socket is horrible, and makes the protocol very brittle under even the slightest network decay or packet loss. Any level of head-of-line blocking severely degrades the entire stream, even for unrelated requests.
Sure it CAN work better than HTTP1.1 under ideal network conditions, but any network degradation is severely amplified, to a point where even for traffic within a datacenter can amplify network distruption and cause an outage.
HTTP3 however is a refinement on those ideas, and gets pretty much everything right afaik.
I'm predicting that eventually Google will start deranking HTTP 1.1 websites.
You do not see how lack of built-in authentication increases complexity of implementing your own website as opposed to "outsourcing" stuff to Gmail, Google Docs and so on? You don't see the zillion "sign in with Google" buttons all over the web? You don't see how cookies are abused for tracking, which benefits Google orders of magnitude more than it would a smaller company?
It's in no way easier than adding keycloak authentication for example, which is another (selfhosted) external authentication solution.
Social auth isnt there to make authentication easier for the website owner. He still has to do everything he'd have to do if he didn't use it.
It's there for the users, do they don't need to remember a bazillion passwords
Google, a multi-billion dollar corporation that owns most of the browser and search market share, a company that dictates the next transport-layer protocol we will use - this company struggles to design a session-handling mechanism that would out-compete an ugly hack that Netscape ductaped to HTTP in mid-90s.
[1] https://varnish-cache.org/docs/trunk/phk/http20.html#beating...
Cookies were a hack to add sessions on top of http.
[1] https://varnish-cache.org/docs/trunk/phk/http20.html#beating...
HTTP1/2 = TCP, which has dedicated hardware to offload major parts of the protocol overhead.
QUIC = UDP, but re-implements some features of TCP in software, leaving the CPU to handle things it didn't have to before.
I plan on purchasing the book as reviewed by this blog post: https://petewarden.com/2015/10/08/smartphone-energy-consumpt...
Wasn't Google already publishing and promoting QUIC before SPDY got adopted as the basis for HTTP/2? SPDY was more conservative because it didn't replace TCP, QUIC wasn't a fix for SPDY being broken, it was a concurrent and less conservative effort poo.
With my "Rust core team member" hat on, normally I'd want to see one good go-to library for an ecosystem. With my "I love web protocols" hat on, I want to see dozens of independent implementations. I wear hat #2 more than hat #1 when it comes to HTTP/3.
To get critical mass for HTTP/3 we'll need large server implementations (eg Cloudflare) and large client implementations (eg Chrome and Firefox) to build support and drive adoption. Which is what is happening!
Contrast this to v6 adoption which requires software support _and_ support from hardware vendors, network operators, etc.
Are you referring to Layer 4 here? SCTP and DCCP may want to have a word with you. :)
I suppose HTTPs equivalent of that would be various http proxies, but in that case barely anyone uses them.
The client uses its local knowledge (and maybe other heuristics) to decide if it wants to change protocols.
1. User type http://example.com into browser
1a. Browser does DNS lookup example.com AAAA or A -> 10.20.30.40
2. Browser connects to 10.20.30.40 TCP port 80 and speaks HTTP/1.1 over that port, announcing Host: example.com where it gets given a 301 redirect to https://example.com (and HSTS pre-load would skip this step)
3. Browser connects to 10.20.30.40 TCP port 443, using SNI for example.com where it is offered an ALPN option h2 (meaning HTTP/2.0) and it takes that option and speaks HTTP/2.0
4. Browser receives Alt-svc: h3=":12345" which is an announcement that this same HTTPS service is available as HTTP/3 using UDP port 12345 from the same IP
5. Now for any future resources from https://example.com/ the browser knows it could get them using HTTP/3
In future, maybe, perhaps, a new DNS record (only really practical via DPRIVE such as DoH since useless middleboxes will probably make this undeployable without) will do what the SRV record was trying to do, but this time focused on HTTP servers in particular. So with that record (again, not even a draft exists for this yet AFAIK):
1. User types http://example.com/ into browser
1a. Browser uses DoH to ask HTTP-SERVICE DNS lookup example.com -> big pile of stuff about how to get this service. If the DNS lookup fails it tries asking for A or AAAA instead.
2. Browser intuits from the big pile of stuff to do QUIC to 10.20.30.40 UDP port 12345, and then speaks HTTP/3.
There is a draft [1] that would support Alt-Svc in DNS. Lots to consider there but it is being presented to IETF.
[1] - https://tools.ietf.org/html/draft-nygren-dnsop-svcb-httpssvc...
Of course you can imagine these are rogue actors off developing technology that's hostile to their employer's needs. But, like, Occam's razor. It seems simpler to assume that these outfits see improving the place where they make money (the web) as just good business.
> They also enable aliasing of apex domains, which is not possible with CNAME.
That would help eliminate a major annoyance of using a CDN.
> a lot of nodes,
Not that many, say three or four servers at most should IMHO be fine for the vast majority.
> a lot of bandwidth,
If your service gets popular enough that you need that much bandwidth, you can then very likely get enough funds to get adequate bandwidth. (Either by commercializing or by donations.)
> DoS mitigation
If you have four servers on four different networks, how hard would someone have to DoS them all before all four give out? And, maybe at least one of those four servers are placed on an ISP which is actually somewhat competent in helping you to filter out DoS traffic? Cloudflare doesn’t have some secret magic sauce, you know.
> and, ideally, a way to get clients to use a local point of presence.
That’s technically true, but only if you are desperate for your latency enough to merit such needs. But you probably aren’t. You are, most likely, much more served by optimizing your server caching and HTML page code than you would be by trying to claw a few extra milliseconds out of the network itself.
If you are desperate to get a few extra milliseconds, and already have a dead-simple homepage, and are enormously popular enough to merit it, then you are Google, and you can solve this problem by means not available to mere mortals.
I have written before in more detail why Google et al. probably doesn’t want SRV records: (In short, SRV solves problems for other people which Google have already solved for themselves, and Google would like to keep their moat.)
Isn't the critical path determined by the availability of web servers and client libraries? I get the importance of browsers, but I would guess that having HTTP/3 supported by projects such as Apache or nginx or curl is far more critical.
It seems everyone recognizes this and so both clients and servers are getting implementations going to make sure this all goes smoothly.
The problem with IPv6 is that it needs to be everywhere at once before it is useable, while protocol like http can be deployed incrementally and can coexist just fine with other protocols[1]
Anything you decide needs to be private doesn't benefit from this cache. So, maybe we can cache the little Y-combinator logo, but not anything anybody wrote? The Youtube help pages, but not any videos? It just doesn't seem like there's any plausible way this isn't either horribly invasive or largely useless or both.
For example, let's say site G, well known for fingerprinting and tracking, wants to estimate how long since you last visited site W recently. W uses modern software engineering recommended practices: CI/CD with several deploys a day, heavily minimised EMCAScript, various icons too.
When you visit any page on G, G serves you a page that uses 37 scripts (called "signals") of particular exact, minified versions, which G happens to know M has served on any particular day. The scripts are loaded in such a way that they don't really do anything.
From that, G can estimate when you visited W, and on what day.
This works so well that G starts adding invisible iframes or AJAX calls to signed copies of entire popular pages from W, and through that, works out exactly what you've been reading. It takes a while because people read different things, but guess by guess, they build up a profile of your W reading habits over time, and the more accurate the profile becomes, the better they are able to estimate what pages to check next.
They do this even though you don't visit G all that often, because G's page does its measurements continuously while the page is loaded. You try turning off JavaScript, but G's A/B test-driven AI helpfully evolves a clever workaround with nested iframes and meta-refresh, so it doesn't make much difference.
Eventually this is done in G's ServiceWorker so it trickles along in the background, and G keep the bandwidth usage low enough that you don't notice. Battery consumption is hardly affected because they run their probes at the same time as the ubiquitous mobile-server-to-client-notification service wakes up the radio. Which 99% of users have running all the time.
A kind of "web crawling", if you will, but crawling the client's history, crawling shared, signed ETags just by trying them.
If you are talking about a separate, non-intermediary cache service, this is neither part of HTTPS or HTTP. While there are certainly third party implementations that work this way, there isn't a generalized approach out there to solve this. Instead you have things like software caching services specific to a particular vendor, or things like Google AMP.
> QUIC also combines the typical 3-way TCP handshake with TLS 1.3's handshake. Combining these steps means that encryption and authentication are provided by default, and also enables faster connection establishment. In other words, even when a new QUIC connection is required for the initial request in an HTTP session, the latency incurred before data starts flowing is lower than that of TCP with TLS.