Re: HTTPS-RR and ECH

--===============5228739129055324239==
Content-Type: multipart/alternative; boundary="00000000000058f7c90657d4d7de"

--00000000000058f7c90657d4d7de
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

>
> > It's more than a proposal. ECH is defined in RFC 9849. It's live and in
> > use.
> >
> > It hides the SNI from passive network snoopers. I think that's a good
> > step forward.
>
>
RFC designation merely codifies protocol specifications; execution dictates
reality. Until code runs reliably in a production binary, a document is
static telemetry on a display. Protocol specifications do not route packets=
.

One example of poor specification: *HTTP/2 Server Push (RFC 7540)* was
fully specified, marketed as a performance breakthrough, and written into
standards. In production, it introduced cache race conditions, wasted
bandwidth, and created complex edge state management=E2=80=94ultimately lea=
ding
major client engines to deprecate and remove it entirely. An RFC existing
provides zero guarantee of long-term viability or sound architectural
design.

Hiding the Server Name Indication (SNI) from path-level network observers
simply redirects the telemetry vector to the central recursive resolver and
CDN ingress. Observation is not eliminated; it is concentrated.

Conflating browser-layer security models with programmatic transport
utilities like curl reflects a fundamental misunderstanding of operational
scope. Interactive browser sessions differ vastly from programmatic client
execution. A user-developer seeking true network privacy deploys encrypted
tunnels or virtual private overlays, securing the transport boundary in its
entirety while preserving the simplicity and predictability of the
underlying binary.

Injecting obscure DNS and TLS handshake mechanics into a foundational
network library trades architectural elegance for trivial obfuscation. As
for c-ares: requiring a specific asynchronous resolver to process HTTPS
resource records is an implementation bottleneck, not a validation of its
design. A user-developer choosing to link that dependency is simply
inheriting structural complexity.

--00000000000058f7c90657d4d7de
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_quote gmail_quote_container"><blockquo=
te class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid rgb(204,204,204);padding-left:1ex">&gt; It&#39;s more than a proposal=
. ECH is defined in RFC 9849. It&#39;s live and in <br>
&gt; use.<br>
&gt; <br>
&gt; It hides the SNI from passive network snoopers. I think that&#39;s a g=
ood <br>
&gt; step forward.<br><br></blockquote><div><br></div><div><p>RFC designati=
on merely codifies protocol specifications; execution dictates reality. Unt=
il code runs reliably in a production binary, a document is static telemetr=
y on a display. Protocol specifications do not route packets.</p><p>One exa=
mple of poor specification: <b>HTTP/2 Server Push (RFC 7540)</b> was fully =
specified, marketed as a performance breakthrough, and written into standar=
ds. In production, it introduced cache race conditions, wasted bandwidth, a=
nd created complex edge state management=E2=80=94ultimately leading major c=
lient engines to deprecate and remove it entirely. An RFC existing provides=
 zero guarantee of long-term viability or sound architectural design.</p><p=
>Hiding the Server Name Indication (SNI) from path-level network observers =
simply redirects the telemetry vector to the central recursive resolver and=
 CDN ingress. Observation is not eliminated; it is concentrated.</p><p>Conf=
lating browser-layer security models with programmatic transport utilities =
like <code>curl</code> reflects a fundamental misunderstanding of operation=
al scope. Interactive browser sessions differ vastly from programmatic clie=
nt execution. A user-developer seeking true network privacy deploys encrypt=
ed tunnels or virtual private overlays, securing the transport boundary in =
its entirety while preserving the simplicity and predictability of the unde=
rlying binary.</p><p>Injecting obscure DNS and TLS handshake mechanics into=
 a foundational network library trades architectural elegance for trivial o=
bfuscation. As for <code>c-ares</code>: requiring a specific asynchronous r=
esolver to process <code>HTTPS</code> resource records is an implementation=
 bottleneck, not a validation of its design. A user-developer choosing to l=
ink that dependency is simply inheriting structural complexity.</p></div><d=
iv><br></div><div><br></div><div>=C2=A0</div></div></div>

--00000000000058f7c90657d4d7de--

--===============5228739129055324239==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library
Etiquette:   https://curl.se/mail/etiquette.html

--===============5228739129055324239==--