Re: [quicwg/base-drafts] Guidance for port number use (#495)

[Mike Bishop <[e-mail]>]

> Run a server as non-root....

This is a separate issue again.  By using Alt-Svc to find the HTTP/QUIC endpoint, we're still requiring that the authoritative server be on **TCP** 80 or 443.  Which means you still need whatever privileges are required to do that, at least on the authoritative endpoint.  Sure, you can run alternatives with less privilege, but that doesn't help the "vulnerabilities in low-budget webservers."

> Multihosting QUIC on IPv4 without SNI....

This seems already achieved by your pull request.  By highlighting that the alternative can be on any port, the CDN is free to use ports however it wants, including handing out individual ports to individual origins.  Of course, there's the grease piece of this, in that if it's not actively exercised, it's unlikely to keep working, so *someone* should start doing this early.

> Do P2P QUIC without fighting network ossification.

This, to me, is the big argument for a "SHOULD randomize" suggestion for server operators.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/495#issuecomment-299272272