Re: [Http-grease] Getting started

[David Schinazi <[e-mail]>]

Hi folks,

Adding some thoughts from the Chrome client perspective.
First off, I think this is interesting, important, and timely.
I'll do what I can to ensure Chrome participates in this effort.

As par as deployment process, we would most likely start
this off in Chrome Canary, then proceed through Dev,
Beta and Stable if the breakage is low enough (though
I don't yet know what exact number is "low enough"...).
For this to be a success, I think we're going to need to
deploy this is stable/prod channels to make it impossible
to ignore. We would be able to leverage Chrome's
experimentation framework to allow dynamically configuring
grease parameters and roll things back if the breakage is
way too high.

I would argue against any type of fallback, because if the
user does not see the failure, they won't report it, and it'll
never get fixed. Even something that increases pain by
making the request take longer won't be enough to cause
change.

I think it's important for clients to coordinate, so the breakage
and corresponding triaging is spread across all of us. That said,
I don't think we need to pick an explicit date like we did for the
deprecation of TLS 1.0/1.1. In particular, I think it would be useful
to coordinate on the exact scope of the greasing: what characters
are part of the random set for example. Similarly, we'll all benefit
from sharing results: if the exclamation point character is known
to break 42% of  the Web, then it's not worth greasing that in our
first wave of grease attempts.

Hope this helps,
David

On Fri, Jul 10, 2020 at 12:21 AM Mark Nottingham <[e-mail]> wrote:

>
>
> > On 10 Jul 2020, at 5:43 am, Tommy Pauly <[e-mail]> wrote:
> >
> > - Deploying on betas (or for us, internal builds) makes this *much* more
> palatable in general, so it may be good to start out with clients doing it
> on beta deployments, and only move to production-scale later
>
> This makes me wonder whether we should just try it with as many clients as
> can opt in on those channels, with a value that's really simple. As a
> bonus, we could use it to get more folks to participate here -- e.g.,
>
> Grease-1: "https://bit.ly/http-grease"
>
> .... where that link would lead to a document explaining what we're doing,
> or it could be an implementation-specific link. After appropriate notice
> and discussion, of course.
>
> Cheers,
>
>
> --
> Mark Nottingham   https://www.mnot.net/
>
> --
> Http-grease mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/http-grease
>