Re: [TLS] Next protocol negotiation

[Marsh Ray <[e-mail]>]

Adam Langley wrote:
> On Wed, Jan 20, 2010 at 7:39 AM, Nikos Mavrogiannopoulos
> <[e-mail]> wrote:
>> Ok now I see your point. However I still suggest solving issues at the
>> appropriate layer, even that has some performance cost.
> 
> The appropriate layer for protocol disambiguation is TCP.
> Unfortunately, this mechanism has stopped functioning for practical
> purposes and we're aware that we aren't the only group facing this
> problem.

One point of view is that firewall admins are ports because of their
intentional policies and it is their right to control what goes on on
their own network. Port 443 is going to be less useful over time as more
sites deploy SSL-inspecting proxies.

I don't particularly like that point of view, but it does seem to be the
reality. So we have a situation where people desiring to make a new
simple, secure protocol have to smuggle their traffic (even outbound
connections) like some kind of malware.

Once we're honest about what we're doing, other options might be available:

Port 443 to a proxy server with the CONNECT verb usually works.

It is rumored that many firewalls will pass anything over port 53.

On many corporate Windows PCs, the 'proxy server' info available in the
registry is the only reliable way to make outbound connections.

> Burning an additional round trip on protocol discovery is unacceptable
> for us[1]. 200ms is a good round-trip time on a 3G network and the
> nature of web content means that progressive discovery of additional
> resources amplifies this delay.
> 
> Also, consider that without a suitable mechanism, we might be
> condemning future protocols to forever limiting their initial
> handshake to something that is HTTP compatible.

You might also be able to use HTTPS to tunnel to an appropriate proxy.

> We (Google) don't mind
> putting in the work to make more fundamental changes but others,
> perhaps, would choose not to for reasons of expediency, and would pay
> this technical debt forever more.
> 
> [1] http://googleblog.blogspot.com/2009/06/lets-make-web-faster.html

Thank you guys for caring about 200ms of my finite lifetime.

- Marsh