News for hackers. Stuff that matters.
Re:WebTransport is almost here to allow UDP-like exchange in... by Aurornis on Monday November 17, 2025 @02:08PM (#45956856)
Designed a protocol to supersede an old one is a good design goal. It makes encompassing all of the previous functionality and use cases a design priority.

It doesn't imply that websockets would be deprecated by WebTransport. It's a goal to make WebTransport an easy choice.

> Also, it's messed up that WT is only available in HTTPS. There are so many cool use cases for web technologies in local contexts where HTTPS is not a practical option

WebTransport is relatively heavy compared to websockets. Once you consider all of the layers, HTTP/3, possible HTTP/2 fallback, and transports, adding TLS is minimal overhead for code size.

For contexts where setting up certificates is not practical, I assume the workaround will be to generate a self-signed certificate and then tell the client to ignore certificate validation problems.

Re:WebTransport is almost here to allow UDP-like exchange in... by mort96 on Monday November 17, 2025 @02:21PM (#45957069)
Performance isn't really my main concern; I have some projects with configuration web GUIs running on MCUs where it could matter (especially the code size to include mbedtls), but most of the stuff I care about is on Linux machines which are powerful enough that it doesn't matter.

See my response to the certificates thing here: https://news.ycombinator.com/item?id=45820782#45956556

Re:WebTransport is almost here to allow UDP-like exchange in... by Aurornis on Monday November 17, 2025 @02:33PM (#45957265)
> I have some projects with configuration web GUIs running on MCUs where it could matter

I don’t think these are a fit for an entire HTTP/3 or HTTP/2 stack with WebTransport anyway.

WebSockets is fine for these applications and won’t be going away.

> See my response to the certificates thing here

If you don’t care about validating the certificate you can skip all of the renewals and DNS setup and everything else. The client will complain that it can’t verify the certificate against anything trusted and you tell the client that’s okay, just ignore it and continue.

If you don’t care about encryption then you also don’t care about setting up the certificate properly. You put something in there to enable the connection and then have the client ignore the fact that it’s not verified.

If your complaint is that browsers show warning signs for certs that can’t be validated and those might scare other users, that’s not going away.

Re:WebTransport is almost here to allow UDP-like exchange in... by mort96 on Monday November 17, 2025 @02:37PM (#45957320)
I don't think you understand. I don't want to make services which, by design, show scare screens to people and make it sound like they're being hacked. It's better to use HTTP and restrict myself to features which work in "insecure" contexts.
Re:WebTransport is almost here to allow UDP-like exchange in... by layla5alive on Monday November 17, 2025 @02:14PM (#45956967)
There are material performance overheads to TLS