← Back to context

Comment by geoctl

16 hours ago

QUIC isn't really about the web, it's more of a TCP+TLS replacement on top of UDP. You can build your own custom L7 on top of QUIC.

15 comments

geoctl

Reply
AnthonyMouse  7 hours ago

QUIC uses Web PKI and TLS. TLS is not a simple protocol and the main reason to use it over something simpler is if you need it to be compatible with something else that already uses it, like HTTPS.

bb88  15 hours ago

You can build a custom L7 on top of anything, really. I think my favorite was tcp/ip over printers and webcams.

The question is what does QUIC get you that UDP alone does not? I don't know the answer to that. Is it because firewalls understand it better than native wireguard over UDP packets?

  • zamadatix  14 hours ago

    Mostly because WireGuard (intentionally) didn't bother with obfuscation https://news.ycombinator.com/item?id=45562302 goes into a practical example of QUIC being that "layer above WireGuard" which gets plugged in. Once you have that, one may naturally wonder "why not also have an alternative tunnelling protocol with <the additional things built into QUIC originally listed> without the need to also layer Wireguard under it?".

    Many design decisions are in direct opposition to Wireguard's design. E.g. Wireguard (intentionally) has no AES and no user selectable ciphers (both intentionally), QUIC does. Wireguard has no obfuscation built in, QUIC does (+ the happy fact when you obfuscate traffic by using it then it looks like standard web traffic). Wireguard doesn't support custom authentication schemes, QUIC does. Both are a reasonable tunneling protocol design, just with different goals.

  • remexre  14 hours ago

    Encryption and reliable transport.

    • zamadatix  14 hours ago

      You really don't want reliable transport as a feature of the tunnel unless you are _intimately_ familiar with what all of the tunneled traffic is already doing for reliable transport.

      The net result of two reliable transports which are unaware of each other is awful.

    • bb88  14 hours ago

      I probably should have clarified that question.

      What does QUIC get you that TCP over Wireguard over UDP does not?

nine_k  15 hours ago

Where is DNS on top of QUIC? Asking unironically.

  • geoctl  14 hours ago

    There is actually. A way more interesting re-implementation of a popular L7 is SSH over QUIC. SSH has to implement its own mutual authentication and transport embedded in the protocol implementation since it operates on top of plaintext TCP, but with QUIC you can just offload the authentication (e.g. JWT bearer tokens issued by IdPs verified at L7 or automatically via mTLS x509 certs) and transport parts to QUIC and therefore have a much more minimal implementation.

    • frumplestlatz  9 hours ago

      “Offloading” authentication onto complex web tech isn’t really a feature unless you already need to be operating in the web space for some other reason.