Hacker News Reader

Comment by tonymet | Hacker News Reader

For one we’re limited to TCP and UDP– without a better protocol for media streaming .

authentication was omitted , resulting in horrifying UX and security holes

and the omission of encryption led to sloppy tunneling solutions that are still being reworked 50 years later

Authentication and encryption- I believe we would be in the same place we are today, with these responsibilities being delegated to the application layer, as the features of auth&enc changed faster than OS vendors are prepared to support.

Eg how much longer would we have had to wait for ChaCha20-Poly1305 in web traffic if we had to wait for the major OS vendors to upgrade? And would they have backported this support to earlier OS versions? Probably not.

> For one we’re limited to TCP and UDP– without a better protocol for media streaming .

What's wrong with UDP for media? Is it the lack of multicast?

> authentication was omitted , resulting in horrifying UX and security holes

While this is painfully obvious now I don't think the original Internet pioneers have ever really thought of the need for authentication as the ubiquity and threat landscape was very different. Regardless, we're all paying the price now.

that’s like saying addresses are enough to deliver mail. there’s still flow control , error correction , buffering , authentication , stream multiplexing, compression, encoding etc etc

streaming protocols handle this at the app layer but it would have been nice to have a protocol between reliable tcp and wild west udp

I don't think most of these things should live at the Transport Layer personally. I am certainly a fan of SCTP but SCTP hasn't yet received widespread middlebox adoption. Unfortunately, the state of IP Media is pretty terrible. SIP/RTP/RTMP are all very complicated and fiddly to get working. The WebRTC stack, which wraps some of these protocols up, is its own beast. XMPP media stacks tend to be IMO the "simplest" and even they are quite complicated.

As someone who's rolled a few custom UDP network stacks I would tend to agree.

UDP is pretty low level(yay MTU discovery) but it gives you most of the tools you need which is why a good number of SCTP implementations are just built on top of it.

UDP supports multicast

but the internet as a whole stopped a long time ago - is there still an MBONE?

MBONE, now there is a name I have not heard in over 20 years.

You do know him then?

that's not quite right. Bellovin et al in the late 80s early 90s really made a big push for authentication infrastructure (SPKI). but at the time PKI was being held hostage by ITAR (I remember sending off to get permission to use the RSA library, and getting something back several months later.

so yes, many of the people working on these things didn't have a security mindset (I had unix accounts at all kinds of random places), but some did...and the US DoD really threw cold water on the whole business

Interesting, thanks, I didn't know about this. I'll do some reading into SPKI. Do you know if these discussions are written down/chronicled somewhere?

He’s talking about late 80s , early 90s. Go back a few more years. Definitely before HTTP. FTP authentication was optional and I think sent in plain text or some really simple encryption (this is before SFTP). Telnet was used everywhere… plain text. And finger… really?

Reply on news.ycombinator.com