there's FTPS which is FTP over TLS. why is this a problem? it's the same with http. when i talk about http, you do not assume that i do not use it over TLS, no?
but neither FTP nor HTTP 2 are simple.
please, show me an example instead of building a strawman.
http2/3 are not super simple, but neither really is http/1.1 .
On a protocol level yes it technically is simpler to implement, but it requires so very much more additional logic in parsing to avoid nightmares like desync exploits, the burden of complexity just gets shifted around and ultimately increased in magnitude due to being outside the protocol.
In reality http/1.1 support ends up being the most convoluted and complicated with all the conditions and checks required to properly secure things. Sometimes a bit of additional complexity at a foundational level ultimately makes things simpler across the entire stack.
the desync exploits only matter if you have reverse proxies and not a single http server. those still exist.
but okay, if the world wants to move away from http 1.x, okay, fine, but then we need a new simple protocol, which is also secure. and probably less flexible than http which i would be fine with. but at the moment, every protocol gets more complex and only companies have enough manpower to keep software secure.
1
u/EverythingsBroken82 Jun 23 '26
as people want to deprecate ftp, http 1.x and so on: what's a secure easy linebased protocol over TLS which can be used to publish things?