Re: 回复： A non-TLS standard is needed

[Paul Vixie <[e-mail]>]

On Wednesday, 29 April 2020 03:31:29 UTC 援北斗兮酌桂浆 wrote:
> The plaintext-QUIC is not used between human beings under the same
> sub-network. It is used between server-machines.
> Server-machines for solving same service in the same equipment room needn't
> encryption while communicating between each other. If we use QUIC for
> these machines communicating between each other, a non-TLS standard is
> needed. 

so, i happen to agree, but i also understand very deeply why others disagree. 

first, it's assumed that you have some control over how your servers behave, 
and can program or configure them to use HTTP over TCP, with no TLS or UDP. 
you don't need and won't miss the advantages of QUIC in a pure LAN 
environment.

second, it's widely known that nation-state attackers, mostly domestic but 
also some foreign, will be able to tap into your LAN if they see a need to do 
so, and that this will create risk for all of your counterparties, and for you 
also. the risk to your counterparties is seen as a public digital health risk; 
if your LAN is tapped by some attacker, it could hurt entire economies or even 
the entire world. the injury would be small, but can be like a thousand 
stings.

this community believes it is acting in the public's interest, and has reached 
a consensus that creating new ways to communicate non-secretly is not in the 
public's interest. such non-secret methods are available now, and can still be 
used by any operator who prefers them.

i was in the minority on these decisions, so please don't shoot the messenger.

(my reason for disagreement has to do with hypervisors and sea level rise; to 
be detailed over beer if i'm ever able to see any of you in person again.)

-- 
Paul