logoalt Hacker News

pcthrowaway06/16/20255 repliesview on HN

You could deploy a new version, you'd just have older clients unable to connect to servers implementing the newer versions.

It wouldn't have been insane to rename https to httpt or something after TLS 1.2 and screw backwards compatibility (yes I realize the 's' stands for secure, not 'ssl', but httpt would have still worked as "HTTP with TLS")


Replies

josephg06/16/2025

> It wouldn't have been insane to rename https to httpt or something after TLS 1.2 and screw backwards compatibility

That would have been at least little bit insane, since then web links would be embedding the protocol version number. As a result, we'd need to keep old versions of TLS around indefinitely to make sure old URLs still work.

I wish we could go the other way - and make http:// implicitly use TLS when TLS is available. Having http://.../x and https://.../x be able to resolve to different resources was a huge mistake.

show 2 replies
ekr____06/16/2025

This has a number of negative downstream effects.

First, recall that links are very often inter-site, so the consequence would be that even when a server upgraded to TLS 1.2, clients would still try to connect with TLS 1.1 because they were using the wrong kind of link. This would relay delay deployment. By contrast, today when the server upgrades then new clients upgrade as well.

Second, in the Web security model, the Origin of a resource (e.g., the context in which the JS runs) is based on scheme/host/port. So httpt would be a different origin from HTTPS. Consider what happens if the incoming link is https and internal links are httpt now different pages are different origins for the same site.

These considerations are so important that when QUIC was developed, the IETF decided that QUIC would also be an https URL (it helps that IETF QUIC's cryptographic handshake is TLS 1.3).

tgma06/16/2025

TLS is one of the best success stories of widely applied security with great UX. It would be nowhere as successful with that attitude.

account4206/16/2025

Yes it would absolutely have been insane.

immibis06/16/2025

You mean like the way we use h2:// everywhere now? Oh wait, we don't.