Re: [Doh] How to start HTTP/2?

[Patrick McManus <[e-mail]>]

On Wed, Jan 17, 2018 at 3:18 AM, Stephane Bortzmeyer <[e-mail]>
wrote:

>
> Martin Thomson said it is not a problem because everyone uses TLS and
> ALPN, anyway. But it contradicts what you say about the possibility of
> future changes using other techniques.
>

for h2, everyone does use TLS/ALPN/TCP-443 for the base case.. but if
you're using alt-svc then the host and port are resolved differently. DoH
can use Alt-Svc but DoH (rightly) doesn't reference it. Alt-Svc is an h2
extension (rfc 7838)

hq (HTTP on Quic - an IETF successor to h2) will be a bit more
complicated.. not only will you need TLS and ALPN but you'll need Alt-Svc
(or something like it) for even the base case as TCP/443 isn't going to
work. Again, referencing the details in doh doesn't help a lot beyond
saying "MUST connect via https and SHOULD use h2 or its successors".

One of the reasons this can't be a MUST is actually ensuring a >= h2 path
is nigh impossible given all of abstractions in infrastructure. Its not
meant to say you should always fail the connection if it is not made over
H2, just
a] make sure your implementation offers and tries to use >= h2 in the usual
ways
b] understand that if you're not using >= h2 there are serious scaling and
performance issues

If this can be expressed as non-normative advice in a sentence or three
that would be ok by me but in general I think this is what using https as a
substrate means.