Comment by singpolyma3
20 hours ago
We don't need new versions of http or SMTP because they're already simple and great and they're dumb protocols so there's not much you could ever add
If you want something else you can take your pick based on need from dozens of other options
HTTP 1 is full of parser differential vulnerabilities, which 2 fixes. That is probably its biggest flaw.
SMTP is too chatty - it uses too many round trips for efficient transfer across the internet. It can take several seconds just to get to the point of sending the email data. It also duplicates information between the SMTP envelope and the email body which creates vulnerabilities when they don't match.
For APIs that don't have to work in a browser I suggest JSON lines over TCP, or over TLS.
Most header parsing bugs that affect HTTP1.1 can also affect 2+3. Not in the same style but there are quite a few overlapping ones.
Only when 2/3 translates to 1, as in request smuggling attacks at a reverse proxy.