Re: A proposal

I think if the world moved to plaintext http/2.0, you would find that 
would become supported in Chrome.

Because you know what people do when their browser can't view a site.

------ Original Message ------
From: "Roberto Peon" <>
To: "Adrien de Croy" <>
Cc: "Nicolas Mailhot" <>; "Mike Belshe" 
<>; "Roy T. Fielding" <>; "HTTP Working 
Group" <>
Sent: 20/11/2013 11:18:18 a.m.
Subject: Re: A proposal
>I don't want the headaches of attempting to support something 
>non-encrypted over the public internet and would rather just deal with 
>HTTP/1.1 in the cases where encryption is disallowed or is not 
>On Tue, Nov 19, 2013 at 2:04 PM, Adrien de Croy <> 
>>it is interesting the biggest pushers of mandatory TLS are those who 
>>stand to suffer the least from it.  Browser makers.
>>Are any server makers or (reverse-) proxy makers here proponents of 
>>mandatory TLS?  I can't imagine a server author taking the step of 
>>requiring all their customers to suddenly buy certs.  At least not be 
>>the first to do so.  They are the ones who will have to deal with the 
>>backlash and incredible inertia of getting their customers to change.
>>Without servers supporting mandatory TLS, it's kinda pointless for 
>>browser makers to assert they won't implement plaintext http/2.0.  
>>Since the cert must be installed on the server (not the 
>>client/browser), I think it would be better to let the server authors 
>>take the lead on this surely?
>>------ Original Message ------
>>From: "Nicolas Mailhot" <>
>>To: "Mike Belshe" <>
>>Cc: "Roy T. Fielding" <>; "HTTP Working Group" 
>>Sent: 20/11/2013 8:07:15 a.m.
>>Subject: Re: A proposal
>>>Le Mar 19 novembre 2013 10:45, Mike Belshe a écrit :
>>>>  Alright, well thats all fine, but I really don't know why you're 
>>>>going off
>>>>  on this rant. Can you cite for me the specific quote from anyone on
>>>>  this
>>>>  list who declared or implied that TLS was a comprehensive solution 
>>>>  'security' or 'privacy'? I don't think anyone did, so this rant is 
>>>>  unnecessary.
>>>That's playing with words, Chrome and Mozilla representatives have 
>>>quite clear they wanted to force a TLS-only web for 'security' and
>>>'privacy'. Even though there is a ton of things those browsers could 
>>>*now* to improve privacy without fostering pki on everyone else.
>>>Really, it's getting quite annoying to see all this forceful selling 
>>>TLS in the name of privacy and security while systematically 
>>>any attempt to consider the parts of the protocol that are used to 
>>>mine users now (let's use the business term not emotional appeals).
>>>Nicolas Mailhot

Received on Tuesday, 19 November 2013 22:22:01 UTC