Subject: Re: 2 questions

From: Yoav Nir <[email-masked]>
Date: Wed, 1 Apr 2015 10:01:57 +0300

That project, if successful, will reduce the already-low price of a TLS certificate.

The new enrollment protocol that was discussed in the ACME BoF, if successful, will lower the already-low administrative burden of getting and renewing a certificate.

Neither will make HTTPS free.

Yoav

> On Apr 1, 2015, at 6:51 AM, ChanMaxthon <[email-masked]> wrote:
> 
> Just wondering, have you guys heard of Let's Encrypt project led by EFF and backed by a few major companies including Cisco, providing SSL certificates with a valid trust chain to everybody for free? If that project is successful we may be able to treat any plaintext traffic as deprecated - just deprecate plaintext HTTP/2 upon release as well as plain HTTP/1.1
> 
> Sent from my iPhone
> 
>> On Apr 1, 2015, at 07:15, Stephen Farrell <[email-masked]> wrote:
>> 
>> 
>> 
>>> On 01/04/15 00:07, Poul-Henning Kamp wrote:
>>> 
>>> The only real solution is to make make privacy a protected human right.
>> 
>> It is in theory, says the UDHR. [1] But I think we've wandered far
>> from this list's remit. Happy to continue off list though, or you
>> could sign up to the (quite new) [email-masked] list [2] that was
>> previously hosted at. [3]  ([3] was just migrated to [2] yesterday.)
>> 
>> S.
>> 
>> [1] http://www.un.org/en/documents/udhr/index.shtml/index.shtml#a12
>> [2] https://irtf.org/mailman/listinfo/hrpc
>> [3] https://lists.ghserv.net/mailman/listinfo/hrpc
>> 
>> 
>

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Wed, 01 Apr 2015 07:25:30 +0000

--------
In message <[email-masked]>, ChanMaxthon writes:

>Just wondering, have you guys heard of Let's Encrypt project led
>by EFF and backed by a few major companies including Cisco, providing
>SSL certificates with a valid trust chain to everybody for free? If that
>project is successful we may be able to treat any plaintext traffic
>as deprecated - just deprecate plaintext HTTP/2 upon release as well
>as plain HTTP/1.1

And you think secret services, police chiefs, politicians and
despots are all going to go "Ohh drat..." and just give up ?

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[email-masked]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.

---

From: Maxthon Chan <[email-masked]>
Date: Wed, 01 Apr 2015 15:32:27 +0800

I understand there are still certain places that encryption itself is too expensive to use like microcontrollers, but that does not mean they cannot stick to existing plaintext HTTP/1.1

For those microcontrollers using HTTP/2 would actually introduce more state (aka memory use) and given the compatibility requirement of HTTP/2 they would also have to include a minimal HTTP/1.1 support (aka code size) so ion;t think HTTP/2 would be appropriate for those applications anyway. For pretty much all other applications TLS won’t be expensive at all, according to what I know.

So maybe if Let’s Encrypt is a success we can mark plain HTTP/2 as deprecated after all, since it bring no benefit either way.

> On Apr 1, 2015, at 15:01, Yoav Nir <[email-masked]> wrote:
>

---

From: "Simpson, Robby (GE Energy Management)" <[email-masked]>
Date: Wed, 1 Apr 2015 18:11:11 +0000

On 4/1/15, 3:32 AM, "Maxthon Chan" <[email-masked]> wrote:

>I understand there are still certain places that encryption itself is too
>expensive to use like microcontrollers, but that does not mean they
>cannot stick to existing plaintext HTTP/1.1

So HTTP/2 would be for all use cases *except* micros?  Seems to go against
the intent.  Further, HTTP/2 has many benefits over HTTP/1.1 for embedded
systems.

That said, the "expense" of encryption is not always the underlying issue,
even with embedded systems.  For that discussion, I'll refer to all of the
other threads on this topic.

>For those microcontrollers using HTTP/2 would actually introduce more
>state (aka memory use) and given the compatibility requirement of HTTP/2
>they would also have to include a minimal HTTP/1.1 support (aka code
>size) so ion;t think HTTP/2 would be appropriate for those applications
>anyway.

As someone who has implemented HTTP/1.1 and HTTP/2 for embedded systems, I
have to disagree.

---

From: "Jason T. Greene" <[email-masked]>
Date: Wed, 1 Apr 2015 18:38:23 -0400 (EDT)

> On Apr 1, 2015, at 8:30 AM, Poul-Henning Kamp <[email-masked]> wrote:
> 
> --------

Or anyone else that wants to exercise their basic freedom to decide how they transmit their data!