Hacker News Reader

> If HTTP/2.0 had done this right

Is "right" in your opinion keeping SSL/TLS optional as it is today? Don't we already have the same concerns (legal obligation to MITM HTTPS connections)?

> no mechanism was provided for such legally mandated M-I-T-M

Maybe this is what you meant by doing it "right". How would this look? I'm having trouble imagining how such a mechanism could be securely built into HTTP.

View on HN

It's certainly not a trivial thing to design, but the "GET https://..." proposal floating around solves a lot of the relatively benign cases (company/school smut-proxies etc.)

My point is that HTTP/2 didn't even try, because the political agenda for a lot of people were more or less "death to all client side proxies".

They're entitled to that opinion of course, but given that laws in various countries say the exact opposite, the only thing they achieve by not making space for it in the security model is that the security model will be broken.

Reply on news.ycombinator.com