Re: Slower HTTP for privacy

["Soni L." <[e-mail]>]

On 1/30/23 18:27, Nick Harper wrote:
> It sounds like what you want is Client Hints 
> (https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hints)

Roughly, but it still doesn't eliminate the existing headers altogether.

Client Hints seems to be *positive* hints only, i.e. "send these, please".

What about *negative* hints, i.e. "don't even bother sending these"? How 
do you prevent useless data from being sent?

>
> On Mon, Jan 30, 2023 at 10:48 AM Soni L. <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>
>
>     On 1/30/23 04:44, Fabian Keil wrote:
>     > "Soni L." <[e-mail]
>     <mailto:[e-mail]>> wrote on 2023-01-29 at 11:45:53:
>     >
>     > > It would be appreciated if there were a slower HTTP, with more
>     round
>     > > trips, explicitly designed with privacy negotiation in mind.
>     > >
>     > > Importantly, you can't leak data which you do not have. The
>     best way to
>     > > not have that data is to not receive it.
>     > >
>     > > Why does a server need to accept user agents and a bunch of other
>     > > unnecessary stuff if it isn't gonna use it? Doesn't it just
>     make the
>     > > server more liable for no good reason? Make it possible to
>     turn it off!
>     > > Most of it can just be turned off.
>     > >
>     > > In fact, the simplest servers (static hosting) only really
>     need the URL
>     > > and the Host. Everything else is unnecessary liability.
>     >
>     > It's not exactly what you ask for, but Privoxy [0] has a
>     > delay-response{} response action [1] that is somewhat related.
>     >
>     > Fabian
>     >
>     > [0] <https://www.privoxy.org/>
>     > [1]
>     <https://www.privoxy.org/user-manual/actions-file.html#DELAY-RESPONSE>
>     It's not at all what we ask for! Uh, we mean like, why does the HTTP
>     server have to parse and discard the User-Agent header and another
>     10 or
>     so headers which it has no use for, instead of just... not receiving
>     those headers in the first place?
>
>     Why can't the client send URL and Host, then wait for the server
>     to send
>     a Headers Required message, then send the required headers (which
>     may be
>     none)? Yes, it takes longer (more RTTs), but the best way to improve
>     privacy is to not have the data in the first place.
>