if we could magically do not care about compatibility
how we could redesign/rewrite internet now in order to make it better?
what could've been done better?
how better performance could be?
how we could redesign/rewrite internet now in order to make it better?
what could've been done better?
how better performance could be?
- Not allocating giant slices of IPv6/4 space to corporations or government agencies. Everything must be IPv6.
- Adding proper authentication to BGP.
- Taking off the super powers of CAs
- Not piling up standards on DNS.
- Killing ICANN because it turned out to be a greedy senseless organization.
- HTTPS is the standard, and email servers just follow the auth/encryption just like HTTPS.
- Curve/Ed25519 over P256/386 and RSA.
- TLS 1.3 is the standard, and remove all compromises made to keep the middle boxes happy.
- No PSL. Browser same-origin modal everywhere.
TLS 1.3 has the "compromises made to keep the middle boxes happy" built into it. A Semantically equivalent protocol, which is spelled differently (and thus incompatible with middle boxes in the real world so you could never deploy it) would have the exact same provable security properties, but that isn't TLS 1.3. ekr's "Compact TLS" is roughly this.
The trick most often seen in clients (particularly web browsers) implementing TLS 1.2 and earlier, of downgrading and trying again, does not exist in TLS 1.3.
If you call a TLS 1.3 server, falsely believing that it is only allowed to speak TLS 1.2 to you and so you should not claim to know TLS 1.3, the server will, unsolicited, signal that it does know TLS 1.3 anyway and your client drops the connection. This feature, called Downgrade Protection, was not enabled in Chrome for about a year because - of course - middlebox vendors can't do anything right, but after a 12 month "fix it or else" warning Chrome enabled the feature.
e.g change TCP to $YOLO PROTOCOL, get rid of OSI for something different
1. Change the order of the header fields to have the destination first, then the source;
2. Make the behavior on too large packets be "truncate but still forward" (setting a flag saying this was done), instead of fragmenting or dropping with an ICMP message.