If I had to guess, I'd guess that less than 5% of current internet users have ever knowingly and intentionally used "the internet" via any protocol that wasn't HTTP. Even that might be an overestimation.

Companies like Google and Facebook have effectively turned the web into "the internet" for the vast majority of people. Even e-mail has essentially become "the web" for most people thanks to services like gmail capturing so many uninformed and unsophisticated users. IRC, too, is mostly lost to services like Slack.

Corporate interests have mostly erased the concept of an open, decentralized, multi-protocol internet from the public consciousness.

Could you elaborate?

The Internet is the infrastructure plus a set of protocols, with HTTP being just one of them. The protocols the most heavily used tend to be regulated (at least in the EU...), the rest - not so much. So each time I hear someone talking about "the death of the Internet" when they mean regulation related to the WWW, I feel at least we as "hackers" should remember this important distinction because sooner or later, once the web becomes even more regulated, we might want to turn to these remaining protocols in order to communicate more freely, and without the blessing of people who create web browsers (that became so complex you practically can't compete here unless you have tons of money).

There's a flip side to this: in part thanks to this lack of regulation, anything outside the popular protocols tend to be blocked in an increasing number of network.

I can see this becoming so bad that the only way to communicate freely would be to tunnel our stuff through TLS on port 443. (That is, doing what looks like HTTPS.)

> There's a flip side to this: in part thanks to this lack of regulation, anything outside the popular protocols tend to be blocked in an increasing number of network.

That is definitely not the result of a lack of regulation. The networks doing that are predominantly not public networks like Comcast, they're private internal corporate networks. The issue is they're a large enough minority that they can't be ignored. But that can't be fixed with regulation of public networks.

In fact, it's caused by certain regulations and pseudo-regulations like PCI-DSS, which require the default-deny policies you're referring to.

I stand corrected, thanks.

That's true. Fortunately, if everything else fails, we should always be able to connect on 443 via stunnel for example, no matter what protocol we use. That's the price to pay for the net getting more complex and more abused.

Unfortunately, that's not true. Corporate networks got rid of plain old proxies that just passed anything SSL on 443 many years ago. In order to meet regulatory requirements to record employee communications, pretty much every US company of any decent size uses a proxy (blue coat, zscaler, palo alto, etc.) that executes MiTM attacks on all SSL traffic. If it's something other than HTTP over SSL, or if it's to a blocked hostname, it won't go through.

The sad part is that a lot of people don't even seem to care.

When my relatively small company announced that they were installing a Palo Alto firewall and that everyone needed to install client side certificates in order for web browsers to continue working, it set off major alarm bells in my head that led to one conclusion -- "No more non-work related web browsing at the office. No exceptions."

Most of my coworkers (albeit mostly those in support and not developers, but still people at least somewhat familiar with the way computers work) only cared that they'd still be allowed to visit Facebook during the day.

I was assured that "nobody was actively looking at employee web traffic" but that doesn't matter. They didn't even think it was a big deal to put this new monitoring in writing until I made a big stink out of it, and they added this to the employee handbook:

>Each of these communication avenues are subject to monitoring by the IT Security Manager, a supervisor, or the President. When using any of these communications, be aware that a business record is made, which is retained by the company and becomes the company's property. This business record may potentially contain sensitive personal information related to the sites you are viewing and into which you are logging on, including user/password information. If you do not wish to share such information, it is suggested you do not access those items using [employer]'s network.

We can go one step further, and put our payload into an encrypted body in an innocent looking HTTP request. Thus begins the game of cat and mouse…

I couldn't agree more, the world wide web is definitely just a piece of the internet. I remember the battles over chat protocols, the scourge of p2p protocols and even the move from email to webmail and back again.

The web has always been a bit contentious for instance the browser wars are still being fought in some way even today. The problem is that the web is where developers were able to build without concern over who the powers that be even were but now the web has been turned into a creepy surveillance machine.

Our current president even paid Cambridge Analytica to socially engineer all of us. Turns out the tricks that hackers used to employ have been appropriated for use by the web monopolies. I can't think of a way in which this turns into anything good for the average person.

  the scourge of p2p protocols

Scourge? Which of the peer-to-peer networking protocols is a scourge?

Surely, you aren't suggesting p2p itself is conceptually an abomination in general?

How many people use it this way? Internet without people doesn't have much use. Internet with only geeks on is better, but still pretty limited.

I operate my own mail server. To send and receive email, I use the imap and smtp protocols. No need for the web there, unlike Gmail captives.

There was this thing called "newsgroups", some day before my time. Wasn't the web.

IRC is still a thing. So is XMPP. Isn't the web.

I'm not sure what you mean by "internet without people". There are plenty of people outside of HTTP.

I use Gmail over IMAP and SMTP, only logging in through the web to change server-side mail filtering rules.

But yes, as much as I love the web, it's funny how people forget (or never realized) there are other protocols.