Hacker News Reader

Comment by jeroenhd | Hacker News Reader

The SVCB/HTTPS records won't save us, because of the same reason TLS 1.3 pretends to be TLS 1.2: middleboxes everywhere have been configured to only let traffic to port 80 and 443 through. Almost everyone is running an HTTP 1.1 server so there's completely transparent fallback for those networks, but it also means those records are kind of pointless.

I never really got the point of the new records either. From what I can tell, they're just SRV records. A separate record class could've made sense with DANE, but nobody implemented it.

View on HN

> middleboxes everywhere have been configured to only let traffic to port 80 and 443 through

They are not everywhere though. They are not on the greater Internet. They are not on residential networks. I have access to the full 65535 TCP ports everywhere in the world on my average Internet connection.

These middleboxes you speak of are appliances paid for and placed inside of corporate LANs. They can pay to put more modern ones, or just getting rid of them.

The point is that these middleware appliances we often use as a scapegoat exist only in well-controlled private networks. Why should we care about them?

>The point is that these middleware appliances we often use as a scapegoat exist only in well-controlled private networks. Why should we care about them?

Perhaps for the same reason we only stopped caring about IE 6 after its usage dropped below a tiny percentage.

For better or worse, making your website available to as many groups of people as possible, regardless of their browser selection or network configuration, has been a long-standing goal in the community.

If your website isn't available to folks at the offices of company X because they use appliance Y, through no fault of user Z's, well...that's not ideal, is it?

> Perhaps for the same reason we only stopped caring about IE 6 after its usage dropped below a tiny percentage.

We did? Half of the sites I find posted on HN literally only work in ONE single browser.

Or they could be ignored so that the users drag their IT kicking and screaming into the 21st century once an important enough site necessitates it. Corporate users usually have more direct influence on their IT than ISP customers.

https://blog.chriszacharias.com/a-conspiracy-to-kill-ie6

Exactly! That post I think perfectly encapsulates the typical line of thinking here.

They're present often enough that the people developing the TLS spec had to invent workarounds.

Personally, I would've preferred to ignore the spec incompliant middleboxes, or even report an error about something meddling with the connection to the user when it's obvious they're the cause of any connectivity issues. That's not a very popular approach for spec designers, though, because they're afraid people will blame the new software rather than the Enterprise™ NetworkProtection© box they paid six figures for. After all, the software is what changed, not the box!

I concur. Corporate LANs are to the internet as VMs are to servers. Trunking, VLANs, and NAT have so completely decoupled these networks from underlying infrastructure that the transport protocol itself is little more than an implementation detail. IPv4 remains king because it is well-known and cheap -- the fact that we all settled on using the same interoperable protocol for both LANs and the internet was never a foregone conclusion.

Reply on news.ycombinator.com