News for hackers. Stuff that matters.

A comment on Strengthening HTTP: A Personal View. Parent comment

Re:Strengthening HTTP: A Personal View by rx4g on Wednesday August 06, 2014 @08:36AM (#8142118)
I think he's saying that clients could decide beforehand whether they want to go into HTTPS-only mode, for example.

But this is something clients can actually do today, without the need for a new protocol or any awareness on the server side. URL isn't HTTPS? Don't load it. I actually did a Firefox plugin that implements this, called http-nowhere.

[ Parent | on HN ]
Re:Strengthening HTTP: A Personal View by matthewmacleod on Wednesday August 06, 2014 @09:30AM (#8142321)
But this is something clients can actually do today, without the need for a new protocol or any awareness on the server side. URL isn't HTTPS? Don't load it. I actually did a Firefox plugin that implements this, called http-nowhere.

Yes - and my understanding is that the browser developers are going to require all HTTP2 connections to be over TLS anyway.

[ Parent | on HN ]