Re: Upgrade status for impl draft 1

On 2/27/13 4:43 AM, William Chan (陈智昌) wrote:
>
> QQ over here. Is this assuming only unencrypted HTTP/2? I believe
> Patrick was hoping to bootstrap serving http:// URLs via HTTP/2 over
> SSL, using the external discovery mechanism (DNS most likely). If so,
> I'm unclear on whether or not we need to describe behavior WRT
> TLS-NPNesque negotiation. Perhaps we should fork the thread for this...
>

This *is* possible, but with a big caveat: DNS should offer alternatives
that have the same security level –– UNLESS DNSSEC is in play. 
Otherwise there's a downgrade attack in the making.

Eliot