What an odd way of phrasing it. It should be, "The next major version of HTTP, HTTP/3, will be QUIC and so drop TCP for UDP and require CA based TLS for every single connection. Regular connections not requiring a third party corporation to approve will be impossible."
No?
Http/3 is one application of quic, but sits on top of it.
That’s why it has a separate RFC, which explains that:
> While delegating stream lifetime and flow-control issues to QUIC, a binary framing similar to the HTTP/2 framing is used on each stream. Some HTTP/2 features are subsumed by QUIC, while other features are implemented atop QUIC.
While google did design QUIC with HTTP in mind, you can use QUIC for other protocols e.g. Microsoft has shipped SMB on QUIC in Windows Server 2022. MS also supports direct QUIC uses on Xbox Series consoles and has a guide to use MsQuic with the GDK.
This is so fucking ridiculous. Tried writing my first android app a few months ago, and for reasons wanted to do QUIC. I was absolutely sure this was going to be a no-brainer, as Google more or less being the inventor of it, or at least a very strong proponent, must have made quic a first class citizen of Android and its SDK years ago now. I mean, all their apps use it. Imagine how much in disbelief I was when I learned there is nothing available, except a library that wraps Chrome's network engine and let's you use http3 over quic, but not quic directly. You'd have to fiddle with using a 3rd party native lib and some bindings and whatnot, so I just deleted Android studio and went for a walk. Yes I'm still bitter.
Or can one install an arbitrary CA and limit it to `*.example.com`?
HTTP/3 can be for people/applications that value what is has to offer, and can largely be ignored otherwise.
1. Make CA #1 2. Make CA #2, have CA #1 sign (a certificate for) this CA with a constraint saying it is valid only for DNS names in example.com and nothing else 3. Destroy CA #1 irrevocably 4. Trust CA #1 in your browser or other relying party software 5. You can now use CA #2 to issue with your constraint.
If you care only about specific web browsers, you can modify the browser software (this is practical for Firefox and to some extent Chromium) to alter its built-in trust semantics to give you chosen CA different constraints. Firefox ships with constraints for a handful of CAs which, in Mozilla's opinion, can be afforded such limited trust so you can model your changes on how that works. https://wiki.mozilla.org/CA/Additional_Trust_Changes
It effects human people trying to host a generally accessible public website. Since HTTP/3 using QUIC cannot establish a connection to a site without a cert the public cannot access my hypthetical HTTP/3 website unless I get a corporation to continiously approve of it (ie, letsencrypt).
Distributing my self signed CA chain to the browser mechanisms appropriate for it for every random person around the world that would try to load to my website is not realistic.
For now HTTP 1.1 is still supported by all browsers. But it won't be long till it is phased out "for security" when it no longer makes profit-sense for megacorp browsers to support it (ie, none of their services require it). And when that happens it will no longer be possible to host a website without corporation permission. That's bad.