> I'm hoping it will stay this way.
There's a good reason it will probably stay that way: middleboxes. I wouldn't be surprised if plaintext HTTP/2 is a can of compatibility worms due to broken or misbehaving transparent proxies.
HTTP/2 over TLS bypasses these middleboxes. And even in the case where the broken middleboxes MITM the connection, their TLS handshake won't offer HTTP/2, so it'll fallback to HTTP/1. In case newer middleboxes do offer HTTP/2, they will have been tested against MSIE's HTTP/2 implementation, reducing the chance of compatibility problems.
I think this is still the official IETF position. RFC 7258 "Pervasive Monitoring Is an Attack" is published as Best Current Practice and has not been retracted.
At the very last stage, the IETF appeared to be hijacked by very large telcos (e.g. ATT, Verizon, Ericsson, Comcast) to remove the mandatory requirement for TLS
As an outsider, this look likes a careful co-ordinated attack on the IETF standards process by a small number of "serial IETF professionals" who are paid by the big carriers to be inside the organisation and ensure that standards do the bidding of corporate masters. (some hyperbole there)
Waiting until the last phase restricted discussion, and used the existing momentum to complete HTTP2 standard while removing one of the fundamental reasons for HTTP2 to exist.
It is a very sad day that consumer rights have been compromised by big money. And as the Lenovo Superfish debacle showed, likely it will backfire in the long run.
Here is the consortium: http://www.atis.org/openweballiance/about.asp
Here is an summary I wrote about this topic: http://etherealmind.com/response-open-web-alliance-lobbies-i...
http://arstechnica.com/security/2014/01/nsa-employee-will-co...
I'm hoping it will stay this way. Defaults are important, so it's the platforms' responsibility to support and enforce the "safer" options.
> The fact that it didn’t get in the spec as mandatory was because quite simply there was never a consensus that it was a good idea for the protocol. A large enough part of the working group’s participants spoke up against the notion of mandatory TLS for HTTP/2. TLS was not mandatory before so the starting point was without mandatory TLS and we didn’t manage to get to another stand-point.
Which is interesting, because I remember quite clearly the "Snowden discussion" at the IETF, and there were consensus for an "encrypt everything Internet".
> There is a claimed “need” to inspect or intercept HTTP traffic for various reasons. Prisons, schools, anti-virus, IPR-protection, local law requirements, whatever are mentioned.
Right. So IETF made it non-mandatory so law enforcement can get their "master keys" in a way. Also this "anti-virus" kind of protection, is basically what Superfish was. I'd rather that kind of behavior was stopped.
IETF would better start actually becoming useful and come up with ways to replace the CA system over the next few years, instead of taking protocols from others and ruining them as they standardize them. Otherwise we should rethink a new model for standardization if IETF is as useless/malicious as it is right now.