News for hackers. Stuff that matters.
Re:HTTPS' massive speed advantage by jimktrains2 on Thursday July 21, 2016 @02:38PM (#12139005)
> Well, almost, let's address the "It's not fair" whingers. The HTTPS test is faster because it uses HTTP/2 whist the HTTP test only uses HTTP/1.1. The naysayers are upset because they think the test should be comparing both the secure and insecure scheme across the same version of the protocol. Now we could do that with the old protocol, but here's the problem with doing it across the newer protocol [is that HTTP/2 over TLS]

This doesn't invalidate the argument that you're comparing two things and claiming you're comparing two other things prima facia. For this use-case HTTP/2 will be faster, with or without TLS (if it could be tested). Claiming that it's the TLS that's speeding up the connection, which is what you mean when you say http vs https) is just plain wrong.

Re:HTTPS' massive speed advantage by richardwhiuk on Thursday July 21, 2016 @02:44PM (#12139049)
But the other point is that https now means HTTP/2 or HTTP/1.1, where as http always mean HTTP/1.1 - so I'm not sure that's true.
Re:HTTPS' massive speed advantage by tedunangst on Thursday July 21, 2016 @03:02PM (#12139200)
If https can mean one of two things, but http2 clearly means only one thing, why would anybody choose to use the term https unless they are trying to be deceptive?
Re:HTTPS' massive speed advantage by c22 on Thursday July 21, 2016 @03:23PM (#12139345)
Or of they're trying to refer to the thing that http2 is not?
Re:HTTPS' massive speed advantage by falcolas on Thursday July 21, 2016 @03:05PM (#12139227)
https and HTTP/2 are not the same thing, though. Until HTTP/2 traffic is the vast majority when compared to HTTP/1.1 with TLS, you can't claim https and HTTP/2 are the same.

For example, if you terminate your secure traffic on an AWS ELB (or using S3, or CloudFront), you are serving HTTP/1.1 with TLS. And will be for the foreseeable future.

Re:HTTPS' massive speed advantage by jimktrains2 on Thursday July 21, 2016 @03:33PM (#12139408)
Can you point me to the RFC where https was redefined to not be HTTP/1.1 over TLS?
Re:HTTPS' massive speed advantage by richardwhiuk on Monday August 01, 2016 @09:53AM (#12202350)
https was never defined in an RFC in the first place, as I understand it, it's just defacto used for that since Netscape started.
Re:HTTPS' massive speed advantage by mikeash on Thursday July 21, 2016 @03:17PM (#12139309)
Pretty much the whole point of the article is that when you say "http vs https" you are no longer just saying TLS vs no TLS. It now means something more.
Re:HTTPS' massive speed advantage by jimktrains2 on Thursday July 21, 2016 @03:23PM (#12139342)
But does it? I mean, you can start a WebSockets session with an HTTP request too. No one says a WS server is an HTTP server and that HTTP is a confusing thing now.

HTTP2 can be started via an HTTP over TLS request, that doesn't mean that it's HTTPS as defined in https://tools.ietf.org/html/rfc2818 and https://tools.ietf.org/html/rfc7230

Re:HTTPS' massive speed advantage by mikeash on Thursday July 21, 2016 @05:19PM (#12140157)
If you assume a reasonably recent browser and server, then it does. Certainly one might not grant that assumption, but I don't think it's outright wrong to make it, either. Depends on your approach.
Re:HTTPS' massive speed advantage by jimktrains2 on Thursday July 21, 2016 @05:52PM (#12140356)
Why assume anything? Why not simply call things what they are? The issue is that browsers don't signal that you're using http2 and they decided nor to use a new schema either to help confuse us all. His point is literally based on nothing supporting http2 without TLS. What if something did? Would http also be a meaningless word? Why not call things what they are, not by what the browser is hiding.
Re:HTTPS' massive speed advantage by tedunangst on Thursday July 21, 2016 @03:53PM (#12139556)
To which people are saying, that's wrong. http2 implies https does not mean https implies http2.
Re:HTTPS' massive speed advantage by phyzome on Thursday July 21, 2016 @11:32PM (#12141557)
HTTP 2 is pretty cool, but this is just a bad title.
Re:HTTPS' massive speed advantage by geofft on Thursday July 21, 2016 @02:43PM (#12139039)
> Claiming that it's the TLS that's speeding up the connection, which is what you mean when you say http vs https

But that's the entire argument he's making. It's not what I mean. When I go to my web host's sysadmins and say "I need to use https so I can use service workers," I don't mean "I need to use TLS so I can use service workers." I mean what I said. https was once defined as merely http + TLS (well, SSL), but it has now come to be a protocol/scheme that supports things that http does not. One of those, and certainly the biggest, is TLS. But there are other differences.

This is a comparison between http and https. It investigates the reason why https is faster, and makes it clear that the difference is that https means other things besides TLS.

Re:HTTPS' massive speed advantage by tedunangst on Thursday July 21, 2016 @03:00PM (#12139180)
As clearly noted, IIS doesn't support http2. So if it's http2 you want, telling the IIS sysadmin "I need https" is not going to address your problem.
Re:HTTPS' massive speed advantage by benaadams on Thursday July 21, 2016 @04:37PM (#12139861)
IIS on Server 2016 supports http2
Re:HTTPS' massive speed advantage by tedunangst on Thursday July 21, 2016 @08:52PM (#12141066)
Well, let's imagine for the moment that your sysadmin has chosen to only deploy officially released and supported versions of software by default. Is "please enable https" the best way to communicate that they need to install a beta version of Windows?