Subject: HTTP 2.0 in the clear and over TLS

From: <[email-masked]>
Date: Mon, 29 Jul 2013 16:37:01 +0000

Hi,

HTTP2 must work in the clear and over TLS. This is required because HTTP1.1 and HTTP2 must coexist to ease the migration to HTTP2, and to accelerate HTTP2 deployments.

Regards
Emile

De : Michael Sweet [mailto:[email-masked]]
Envoyé : dimanche 28 juillet 2013 14:12
À : Eliot Lear
Cc : William Chan (陈智昌) ; Zhong Yu; HTTP Working Group
Objet : Re: HTTPS 2.0 without TLS extension?

... and don't forgot some of the more obscure usage of HTTP, such as HTTP over USB in the USB-IF's IPP USB Specification:

    http://www.usb.org/developers/devclass_docs

There isn't much point in using TLS over USB (and a lot of cost issues for that class of printer against it), and we need to continue to use the same USB end points/interfaces, so upgrade remains an important feature of HTTP/2.0 for me/Apple...

Sent from my iPad

On 2013-07-28, at 12:46 AM, Eliot Lear <[email-masked]<mailto:[email-masked]>> wrote:

On 7/23/13 7:34 PM, William Chan (陈智昌) wrote:
FWIW, it seems reasonable to me to have the spec allow HTTPS 2.0 without TLS extension. If you want to Upgrade, be my guest. I have no plans for my browser to support that, and I don't think Google servers will support it either, because we care strongly about the advantages of TLS-ALPN vs Upgrade.

Not only that, I don't think we can reasonably call this HTTP 2.0 if we have no path to do it in the clear.

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: William Chan (陈智昌) <[email-masked]>
Date: Mon, 29 Jul 2013 14:00:05 -0700

No one has said otherwise. Please see the section in the spec where we
provide a way to negotiate HTTP/2.0 in the clear via HTTP Upgrade:
http://http2.github.io/http2-spec/#discover-http.

On Mon, Jul 29, 2013 at 9:37 AM, <[email-masked]> wrote:

>  Hi,****
>
> ** **
>
> HTTP2 must work in the clear and over TLS. This is required because
> HTTP1.1 and HTTP2 must coexist to ease the migration to HTTP2, and to
> accelerate HTTP2 deployments. ****
>
> ** **
>
> Regards****
>
> Emile****
>
> ** **
>
> *De :* Michael Sweet [mailto:[email-masked] <[email-masked]>]
> *Envoyé :* dimanche 28 juillet 2013 14:12
> *À :* Eliot Lear
> *Cc :* William Chan (陈智昌) ; Zhong Yu; HTTP Working Group
> *Objet :* Re: HTTPS 2.0 without TLS extension?****
>
> ** **
>
> ... and don't forgot some of the more obscure usage of HTTP, such as HTTP
> over USB in the USB-IF's IPP USB Specification:****
>
> ** **
>
>     http://www.usb.org/developers/devclass_docs****
>
>
>
> ****
>
> There isn't much point in using TLS over USB (and a lot of cost issues for
> that class of printer against it), and we need to continue to use the same
> USB end points/interfaces, so upgrade remains an important feature of
> HTTP/2.0 for me/Apple...****
>
>
>
> ****
>
>
> Sent from my iPad****
>
>
> On 2013-07-28, at 12:46 AM, Eliot Lear <[email-masked]> wrote:****
>
>  ** **
>
> On 7/23/13 7:34 PM, William Chan (陈智昌) wrote:****
>
>  FWIW, it seems reasonable to me to have the spec allow HTTPS 2.0 without
> TLS extension. If you want to Upgrade, be my guest. I have no plans for my
> browser to support that, and I don't think Google servers will support it
> either, because we care strongly about the advantages of TLS-ALPN vs
> Upgrade.****
>
>
> Not only that, I don't think we can reasonably call this HTTP 2.0 if we
> have no path to do it in the clear.****
>

---

From: William Chan (陈智昌) <[email-masked]>
Date: Mon, 29 Jul 2013 14:01:46 -0700

Sorry, I am inexact. Some people may have previously said otherwise, but
currently to my knowledge no one is vocally opposing including a HTTP/2.0
in the clear mechanism in the spec, and the current draft spec does provide
such a mechanism.

On Mon, Jul 29, 2013 at 2:00 PM, William Chan (陈智昌)
<[email-masked]>wrote:

>> There isn't much point in using TLS over USB (and a lot of cost issues
>> for that class of printer against it), and we need to continue to use the
>> same USB end points/interfaces, so upgrade remains an important feature of
>>  FWIW, it seems reasonable to me to have the spec allow HTTPS 2.0
>> without TLS extension. If you want to Upgrade, be my guest. I have no plans
>> for my browser to support that, and I don't think Google servers will
>> support it either, because we care strongly about the advantages of
>> TLS-ALPN vs Upgrade.****
>>
>>

---

From: Peter Lepeska <[email-masked]>
Date: Mon, 29 Jul 2013 19:12:17 -0400

HTTP 2.0 in the clear will be faster than over TLS. It will be interesting
to see if Google will continue to trade speed for privacy when the standard
supports a faster option.

Peter

On Mon, Jul 29, 2013 at 5:01 PM, William Chan (陈智昌)
<[email-masked]>wrote:

> On Mon, Jul 29, 2013 at 2:00 PM, William Chan (陈智昌) <[email-masked]
> > wrote:
>
>>> ... and don't forgot some of the more obscure usage of HTTP, such as
>>> HTTP over USB in the USB-IF's IPP USB Specification:****
>>>
>>> ** **
>>>

---

From: Fred Akalin <[email-masked]>
Date: Tue, 30 Jul 2013 01:38:16 +0200

Why would HTTP 2.0 be faster in the clear than over TLS?

On Tue, Jul 30, 2013 at 1:12 AM, Peter Lepeska <[email-masked]> wrote:

> On Mon, Jul 29, 2013 at 5:01 PM, William Chan (陈智昌) <[email-masked]
> > wrote:
>
>> On Mon, Jul 29, 2013 at 2:00 PM, William Chan (陈智昌) <
>> [email-masked]> wrote:
>>

---

From: William Chan (陈智昌) <[email-masked]>
Date: Mon, 29 Jul 2013 16:58:53 -0700

I'm not really interested in discussing speculations about what we (Google)
will do in the future. I think we've already made our stance relatively
clear.

---

From: Amos Jeffries <[email-masked]>
Date: Tue, 30 Jul 2013 12:02:35 +1200

> Why would HTTP 2.0 be faster in the clear than over TLS?
For the same reasons HTTP in the clear is faster than HTTPS. Encryption 
overheads, cache offloading, proxy multiplexing amongst others.

Amos

>
> On Tue, Jul 30, 2013 at 1:12 AM, Peter Lepeska <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     HTTP 2.0 in the clear will be faster than over TLS. It will be
>     interesting to see if Google will continue to trade speed for
>     privacy when the standard supports a faster option.
>
>     Peter
>
>
>     <[email-masked] <mailto:[email-masked]>> wrote:
>
>         Sorry, I am inexact. Some people may have previously said
>         otherwise, but currently to my knowledge no one is vocally
>         opposing including a HTTP/2.0 in the clear mechanism in the
>         spec, and the current draft spec does provide such a mechanism.
>
>
>         <[email-masked] <mailto:[email-masked]>> wrote:
>
>             No one has said otherwise. Please see the section in the
>             spec where we provide a way to negotiate HTTP/2.0 in the
>             clear via HTTP Upgrade:
>             On Mon, Jul 29, 2013 at 9:37 AM, <[email-masked]
>             <mailto:[email-masked]>> wrote:
>
>                 Hi,
>
>                 HTTP2 must work in the clear and over TLS. This is
>                 required because HTTP1.1 and HTTP2 must coexist to
>                 ease the migration to HTTP2, and to accelerate HTTP2
>                 deployments.
>
>                 Regards
>
>                 Emile
>
>                 *De :*Michael Sweet [mailto:[email-masked]]
>                 *Cc :* William Chan (陈 智昌) ; Zhong Yu; HTTP Working
>                 Group
>                 *Objet :* Re: HTTPS 2.0 without TLS extension?
>
>                 ... and don't forgot some of the more obscure usage of
>                 HTTP, such as HTTP over USB in the USB-IF's IPP USB
>                 Specification:
>
>                 There isn't much point in using TLS over USB (and a
>                 lot of cost issues for that class of printer against
>                 it), and we need to continue to use the same USB end
>                 points/interfaces, so upgrade remains an important
>                 feature of HTTP/2.0 for me/Apple...
>
>
>
>
>                 Sent from my iPad
>
>
>                         FWIW, it seems reasonable to me to have the
>                         spec allow HTTPS 2.0 without TLS extension. If
>                         you want to Upgrade, be my guest. I have no
>                         plans for my browser to support that, and I
>                         don't think Google servers will support it
>                         either, because we care strongly about the
>                         advantages of TLS-ALPN vs Upgrade.
>
>
>                     Not only that, I don't think we can reasonably
>                     call this HTTP 2.0 if we have no path to do it in
>                     the clear.
>

---

From: Peter Lepeska <[email-masked]>
Date: Tue, 30 Jul 2013 11:28:50 -0400

No need to speculate about Google but in general content owners will have a
tough decision IMHO because TLS costs 1 additional round trip per domain at
minimum (and the number of domains per web site is increasing --
http://httparchive.org/trends.php#numDomains&maxDomainReqs). This gets to
be significant, especially if you are audacious about performance goals --
http://www.strangeloopnetworks.com/blog/are-your-performance-goals-audacious-enough/
.

Peter

On Mon, Jul 29, 2013 at 7:58 PM, William Chan (陈智昌)
<[email-masked]>wrote:

> I'm not really interested in discussing speculations about what we
> (Google) will do in the future. I think we've already made our stance
> relatively clear.
>
>
> On Mon, Jul 29, 2013 at 4:12 PM, Peter Lepeska <[email-masked]>wrote:
>
>> interesting to see if Google will continue to trade speed for privacy when
>> the standard supports a faster option.
>>
>> Peter
>>
>>
>> On Mon, Jul 29, 2013 at 5:01 PM, William Chan (陈智昌) <
>>>>> Not only that, I don't think we can reasonably call this HTTP 2.0 if
>>>>> we have no path to do it in the clear.****
>>>>>

---

From: Martin Thomson <[email-masked]>
Date: Wed, 31 Jul 2013 06:35:38 +0200

On 30 July 2013 17:28, Peter Lepeska <[email-masked]> wrote:
> because TLS costs 1 additional round trip per domain at minimum

This is an interesting point.  Perhaps you would be interested to
learn that a) this is a known problem with a number of well-known
solutions, and b) the TLS working group is talking about starting on
TLS 1.3.  I'll let you draw your own conclusions about this.

---

From: Peter Lepeska <[email-masked]>
Date: Wed, 31 Jul 2013 15:37:58 -0400

That's great to hear. I wasn't aware that TLS wg was considering addressing
this.

Thanks!

Peter