Subject: Re: [Last-Call] Last Call: Status change of HTTP experiments to Historic

From: Adam Roach <[email-masked]>
Date: Fri, 15 Oct 2021 23:17:44 -0500

On 10/14/2021 11:52 AM, The IESG wrote:
> - RFC8164 from Experimental to Historic
>      (Opportunistic Security for HTTP/2)

It's worth observing that this mechanism remains implemented in Firefox 
today:

https://searchfox.org/mozilla-central/rev/13a484992f7cae52f24851c73ff4d19de119d0c0/netwerk/protocol/http/AlternateServices.cpp#1119-1122

On a quick search of mailarchive.ietf.org, I don't see any solicitation 
of input about experience with it, nor any offered lessons from this 
real-life deployment. Given its relative recency as compared to the 
other documents, it may be worth doing some outreach to folks to ask if 
there was anything learned from this deployment. I recommend either 
delaying this action until data is gathered on RFC 8164, or removing RFC 
8164 from this action.

/a

---

From: "Martin Thomson" <[email-masked]>
Date: Mon, 18 Oct 2021 12:34:12 +1100

> It's worth observing that this mechanism remains implemented in Firefox

This feature is being disabled.  We've been meaning to do this for a while now, mainly due to low usage rates[1], but we recently got a little nudge.  Firefox 94 (scheduled for release 2021-11-02) will have the feature disabled.  I expect that we will remove the supporting code in future releases.

The main problem here is the continued increase in HTTPS adoption.  HTTPS offers genuine security and displaces the opportunistic mechanism.  This feature was only ever intended to act as a short-term bridge.  It might not have achieved that goal, but we're happy that the continued improvement in HTTPS (and certificate) availability has made that bridge largely unnecessary.

We also acknowledge that other implementations did not choose to include the feature.  Recognizing that market failure and moving on is healthy.

[1] https://mzl.la/3vncCp2