Re: [apps-discuss] HTTPS-only vs HTTPS-and-HTTP

On Dec 2, 2012, at 12:25 PM, jonathan@gorard.co.uk wrote:

> On 2012-12-02 15:00, Dick Hardt wrote:
>> On Dec 2, 2012, at 12:30 AM, "Paul E. Jones" <paulej@packetizer.com> wrote:
>>> In any case, the current document encourage use of HTTPS.  But, it still
>>> allows for HTTP and I can see some valid cases for it.
>> 
>> What are the avid use cases?
>> 
>> Keep in mind we are adding complexity to clients by allowing both, so
>> there is a real cost to allowing both. I'm not clear what we are
>> losing by HTTPS-only
>> 
>> -- Dick
>> _______________________________________________
>> apps-discuss mailing list
>> apps-discuss@ietf.org
>> https://www.ietf.org/mailman/listinfo/apps-discuss
> 
> Surely mandating HTTPS for all connections would not only increase overhead by forcing SSL key exchange where it isn't necessary, but wouldn't it remove the ability to cache web content, thereby crippling the performance of many content-heavy websites? For sites which don't require secure connections, it just doesn't make sense. The additional complexity on the client from running both protocols that you mentioned is the lesser of two evils (unless the two protocols are somehow integrated).

It is implementation complexity that I am talking about. Per the latest draft, the Client has to first call HTTPS and depending on the result of that call, can call HTTP.

The overhead of SSL is nothing compared to making to calls, and the first has to be SSL anyway!

-- Dick