Hacker News Reader

Comment by tedunangst | Hacker News Reader

It's funny that layer 7 remains in the vernacular. Nobody talks about layer 6 proxies. Or occasionally somebody will mention a layer 3 proxy. But never layer 5.

View on HN

Since noone else has posted it, I will: https://docs.google.com/document/u/0/d/1iL0fYmMmariFoSvLd9U5...

The OSI Deprogrammer

THANK YOU! I have never understood everybody’s fascination with the OSI’s approximative model, but I could never rationalize why. Great read!

I hate the OSI model too, but a 240-page book with 137 references? To complain that a model from the 80s isn't the right fit 40 years later? This isn't a paper, it's a rant.

It's not much of a rant. About half of the actual content is the suggestion of alternatives, and about a third is just historic reference on OSI.

^ This.

Before seeing this here, I went down a rabbit hole on why-anyone-cares about the OSI model, especially as a descriptor for their golang project. It seems to be just a classification that one person found useful, and people treat like an interesting thing.

Separately, we need more deprogrammers in the world.

For folks in the networking space, differentiating between L4 and L7 proxies is pretty important. And while you could call it an HTTP proxy in many circumstances, some proxies support other protocols e.g a mysql proxy.

Yes, IMHO calling it a Layer 7 proxy it quite misleading. I was expecting something closer to an ALG.

Calling a reverse HTTP proxy a Layer 7 proxy is misleading? Why?

Probably because OSI never materialized IRL and today they are all mixed up left and right and not how we “designed” and “imagined” it 50 years ago

I think it's only misleading in that the only L7 protocol it supports is HTTP. It's not a huge deal, but when I work with other proxies if I see L7, I assume multiple application protocols.

In my opinion "application layer" and "transport layer" would be better terms than L7 and L4.

In my last role I started trying to enforce this by refusing to use the terms "Layer 7" and "Layer 4" (I worked on application and transport layer infrastructure at a big tech) but it never caught on and after having to give "the talk" about what happened to OSI Layers a few times I resigned myself to the fate that it was never happening. I will continue to use those terms though.

We think in TCP/IP but use ISO layer names.

https://en.wikipedia.org/wiki/Internet_protocol_suite

That's because layer 5 and 6 don't really make sense in the TCP/IP stack. Maybe you could say TLS is one of those layers, it is definitely a layer between tcp and http, and in haproxy documentation it is layer 6, but it also doesn't map to the OSI concept for those layers, and is often said to be layer 7 as well.

And then there is quic, which is a transport protocol, so kinda layer 4, but it is higher than udp, but it also has TLS built into it.

QUIC has TLS built into it, and also (http) streams, and a few other such goodies (say, masque - tunneling). It definitely "fills the hole" between L4..L7. Or smashes the layers, if you prefer.

And then there is wireguard which does IP over UDP over IP.

Which layer is layer 3 here?

Layers, P's… blimey, leave them all out of my PSTN connections and bring X.25 back!

To rectify this most grievous transgression, I now unveil a device of eternal ingenuity and enchanting craftsmanship, a veritable marvel, which shall restore order to the realm of networking with unparalleled precision and grace: «Whispering X.Gate», a X.25 API Gateway – https://pastebin.com/S11LRJNS

Now add a language translation layer with X.75 :)

Cloudflare "splits" their reverse proxies functionally into different processes; TLS termination may happen in a different process from WAF, or cache access, or origin fetch. I'm sure other large CDNs do similar things.

As others have said, "processing layers" in contemporary network service architecture don't align that well with OSI layers anymore, though.

We used to at least think about it, but noone seems to be running DECNet, GOSIP or the rest any more.

We should add layers 8 and 9: HTTPS and JSON. The future is everything-over-JSON.

aren't SSH tunnels layer six proxies in essence?

Reply on news.ycombinator.com