Comment by austin-cheney
20 hours ago
Why are we still so reliant on HTTP? HTTP came out in 1990 (36 years ago) and the most common version of HTTP still in use, 1.1 (RFC2616), came out in 1999 (27 years ago)?
Yes, I know HTTP 2 and 3 and SSE are attempts to make it faster and more parallel, but its still slow. Its slow because its unidirectional with a full round trip and by default its a new socket per each message. Yes, I know the real reason HTTP became and remains popular is because its sessionless... in theory. Still, there are better options available. You can do so much more with a full duplex channel.
We don't need new versions of http or SMTP because they're already simple and great and they're dumb protocols so there's not much you could ever add
If you want something else you can take your pick based on need from dozens of other options
HTTP 1 is full of parser differential vulnerabilities, which 2 fixes. That is probably its biggest flaw.
SMTP is too chatty - it uses too many round trips for efficient transfer across the internet. It can take several seconds just to get to the point of sending the email data. It also duplicates information between the SMTP envelope and the email body which creates vulnerabilities when they don't match.
For APIs that don't have to work in a browser I suggest JSON lines over TCP, or over TLS.
Most header parsing bugs that affect HTTP1.1 can also affect 2+3. Not in the same style but there are quite a few overlapping ones.
1 reply →
"by default its a new socket for each message" is misinformation - keepalive is the default since HTTP 1.1 (1999).
Keep alive is not default behavior, so my prior comment was still more correct.
All webservers (apache, nginx, litespeed, caddy) have keep-alive enabled by default. All browsers also support it. Whether it's actually used/negotiated on most connections, I don't know, and if you want to be pedantic you're right that it can't be default by definition since you need the header to use it. But I suspect it actually is used for most connections nowadays.
Multiplexing is the default in HTTP/2 and 3. So you're still wrong.
1 reply →
Keepalive is literally the default. You have to send an additional header if you don't want to use keepalive.
Agreed. The issue with all these archaic standards is that they were rolled decades ago back when certain practices were either outright not being employed OR that hardware wasn't fast enough. Ironically, HTTP itself is a literal nightmare to parse (performance wise) on top of having like... ten? distinct vulnerability classes. The world desperately needs new standards.
Just open a TCP socket and send JSON messages. Or if you want a bit more efficiency, fixed-format binary messages, but remember to include a version number.
For custom server implementations, agreed. But the web still depends on HTTP and we sadly need the major infra providers to agree on a new standard otherwise HTTP isn't going anywhere
3 replies →