Hacker News Reader

Comment by austin-cheney | Hacker News Reader

Why are we still so reliant on HTTP? HTTP came out in 1990 (36 years ago) and the most common version of HTTP still in use, 1.1 (RFC2616), came out in 1999 (27 years ago)?

Yes, I know HTTP 2 and 3 and SSE are attempts to make it faster and more parallel, but its still slow. Its slow because its unidirectional with a full round trip and by default its a new socket per each message. Yes, I know the real reason HTTP became and remains popular is because its sessionless... in theory. Still, there are better options available. You can do so much more with a full duplex channel.

View on HN

We don't need new versions of http or SMTP because they're already simple and great and they're dumb protocols so there's not much you could ever add

If you want something else you can take your pick based on need from dozens of other options

HTTP 1 is full of parser differential vulnerabilities, which 2 fixes. That is probably its biggest flaw.

SMTP is too chatty - it uses too many round trips for efficient transfer across the internet. It can take several seconds just to get to the point of sending the email data. It also duplicates information between the SMTP envelope and the email body which creates vulnerabilities when they don't match.

For APIs that don't have to work in a browser I suggest JSON lines over TCP, or over TLS.

Most header parsing bugs that affect HTTP1.1 can also affect 2+3. Not in the same style but there are quite a few overlapping ones.

Only when 2/3 translates to 1, as in request smuggling attacks at a reverse proxy.

Header parsing, sure. But message framing bugs are much more likely with HTTP/1.1.

Agreed. The issue with all these archaic standards is that they were rolled decades ago back when certain practices were either outright not being employed OR that hardware wasn't fast enough. Ironically, HTTP itself is a literal nightmare to parse (performance wise) on top of having like... ten? distinct vulnerability classes. The world desperately needs new standards.

Just open a TCP socket and send JSON messages. Or if you want a bit more efficiency, fixed-format binary messages, but remember to include a version number.

For custom server implementations, agreed. But the web still depends on HTTP and we sadly need the major infra providers to agree on a new standard otherwise HTTP isn't going anywhere

Web uses web protocols, notweb uses notweb protocols. When I write an XMPP bot it has to speak XMPP, not HTTP. I could write my video game server to use XMPP but why the heck would I do that? If I choose a badly fitting protocol, it's on me.

I think one problem there is that a lot of places block other ports. Was that not why websockets runs on http ports?

Websockets have to be careful not to enable a client-side SSRF by accessing anything you couldn't already access with an <img> tag. They can use any port except the ones that are generally prohibited for browser HTTP requests, such as 25 and 6667.

"by default its a new socket for each message" is misinformation - keepalive is the default since HTTP 1.1 (1999).

Keep alive is not default behavior, so my prior comment was still more correct.

All webservers (apache, nginx, litespeed, caddy) have keep-alive enabled by default. All browsers also support it. Whether it's actually used/negotiated on most connections, I don't know, and if you want to be pedantic you're right that it can't be default by definition since you need the header to use it. But I suspect it actually is used for most connections nowadays.

Multiplexing is the default in HTTP/2 and 3. So you're still wrong.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

https://stackoverflow.com/questions/36517829/what-does-multi...

So, for the sake of argument let’s say I am completely wrong, MDN is wrong, all of Stack Overflow is also wrong. Even still HTTP is slow. Slow as shit. Imagine trying to do a MS Teams call with 50+ participants with cameras on. It would be slow as shit for just a one-on-one call. A call with 50+ people would be ridiculously slower and would likely result in a crash from memory exhaustion.

I was also not talking about HTTP2 or 3. I was very clear about that. Reading is hard. HTTP is used in many different contexts outside the browser where 1.1 continues to dominate.

The primary reason developers want to keep HTTP around is familiarity and comfort. HTTP is great when you don’t compare to anything else or do any kind of performance tuning.

Keepalive is literally the default. You have to send an additional header if you don't want to use keepalive.

Reply on news.ycombinator.com