mastodon - Link to source

I started going to IETF meetings. Those events take place 3 times a year, with ~1000 people attending in person and another ~1000 remotely. A good chunk of those are paid to be there and some are employed by big companies like Apple and Google. This is the place where the fundamental fabric of the internet is constantly being improved. TLS 1.3, HTTP/3, MLS to name a few.

With this in mind I have no fucking clue what Moxie was on about when he said interoperable protocols are stuck in the 1990s.

in reply to Daniel Gultsch

snac - Link to source

Giacomo Tesio

#QUIC (and #HTTP3) exists to serve the interests and needs of #Google.

In particular 0-RTT is basically a low-level cookie that allows deterministic user tracking below and before #http: if it will ever spread, disabling or deleting cookies, even out-lawing them, won't be a issue for #SurveillanceCapitalism.

So these days what happens at #IETF is much more lobbying than engineering. Overpaid engineers lobby against the users to further cement the power of their corporations.

I wouldn't call these as "improvements".

These days, sadly, IETF is the place where the fundamental fabric of the internet is constantly being ^^enshittified**.

@lorenzo@snac.bobadin.icu

@lorenzo
in reply to daniel:// stenberg://

mastodon - Link to source

Electrostep

@bagder @giacomo @lorenzo

Thank you for responding.

Just to add to the discussion, it would be great to see any counter-arguments for blog.cloudflare.com/even-faste…, if anyone has the time to contribute


Even faster connection establishment with QUIC 0-RTT resumption

One of the more interesting features introduced by TLS 1.3, the latest revision of the TLS protocol, was the so called “zero roundtrip time connection resumption”, a mode of operation that allows a client to start sending application data, such as HT…
The Cloudflare Blog
@daniel:// stenberg:// @Giacomo Tesio @lorenzo
in reply to Giacomo Tesio

mastodon - Link to source

chrysn

@giacomo @lorenzo IETF protocol specs regularly include sections with privacy considerations just like security considerations. These point out such problems and guide implementers to get them right (eg. to only use 0RTT if user tracking is of no concern because cookies would be on anyway). If a browser implements that wrong, it's for other lacks but awareness.
@Giacomo Tesio @lorenzo
in reply to chrysn

snac - Link to source

Giacomo Tesio

Well @chrysn@chaos.social, I really appreciate your good intentions and will to fight for users' #privacy.
But I was not talking about you or the few independent developers who still volunteer at #IETF these days.
I was talking about IETF effects on the Internet standards as a whole.
I'm afraid the impact of a few independent engineers is not going to balance the power of organized and well funded #BigTech lobbyists.

As an example, let's stay on topic and look at RFC 9001, "Using #TLS to Secure #QUIC".
All that is said about the impoved ability of the server to identify (and thus track) the user are in two lines about session resumption (emphasys mine):

Session resumption allows servers to link activity on the original connection with the resumed connection, which might be a privacy issue for clients. Clients can choose not to enable resumption to avoid creating this correlation.


Now please notice the #hypocrisy: the wording is set up as if clients should opt-in, but it's pretty unlikely that users will be given a choice between a personal data leak at protocol level and an imperceptible increase in connection time, in particular with 0-RTT where " Endpoints cannot selectively disregard information that might alter the sending or processing of 0-RTT".

So while I'm pretty curious about @bagder@mastodon.social's perspective, I see that #Google managed to get a protocol designed to thwart user privacy and reduce its own server costs (even just the energy consumed during TLS hadshakes, amount to thousands dollars each day).

This way, if EU would decide to forbid tracking cookies at all, Google would get a competitive advantage over all other #AdsTech companies.

Now a properly working IETF would have rejected such shit, knowing that it would have been leveraged against people (and democracies) though #Chrome browsers and #Android defaults.

CC: @daniel@gultsch.social @lorenzo@snac.bobadin.icu

RFC 9001: Using TLS to Secure QUIC

This document describes how Transport Layer Security (TLS) is used to secure QUIC.
www.rfc-editor.org

daniel:// stenberg://

2025-11-10 00:06:47

mastodon - Link to source

@electrostep @giacomo @lorenzo no

@daniel:// stenberg:// @chrysn @Daniel Gultsch @lorenzo
⇧