- From: Poul-Henning Kamp <phk@phk.freebsd.dk>
- Date: Fri, 13 Jul 2012 17:37:23 +0000
- To: Phillip Hallam-Baker <hallam@gmail.com>
- cc: "ietf-http-wg@w3.org Group" <ietf-http-wg@w3.org>
In message <CAMm+Lwgr1cnM3-iz_quKhN9N_dS1d6qdv26kSvKZ+T_Hr9L+hw@mail.gmail.com> , Phillip Hallam-Baker writes: >5a) The TLS-HTTP gap > >Now as far as HTTP is concerned, headers have security implications >and so HTTP is not going to be acceptably secure without either >transport layer or packet layer security. I disagree. What HTTP lacks is a clear distinction between "envelope" and "body" the way SMTP and NNTP have it. HTTP/2.0 would enable a lot more sites to run with cryptographic security, if there were an unprotected envelope for load-balancers to act on. I also think it should be possible to mix protected and unprotected requests on the same TCP session. -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 phk@FreeBSD.ORG | TCP/IP since RFC 956 FreeBSD committer | BSD since 4.3-tahoe Never attribute to malice what can adequately be explained by incompetence.
Received on Friday, 13 July 2012 17:37:48 UTC