HTTP/2

It's taking ideas at the transport level, at the application level of how to make a faster protocol.

I did that, put that into a thing we called Speedy, and then that's now known as HTTP2 today.

So I'm the lead author on that.

I was very lucky to have some other people at Google that were excited to make that work.

There's a speed change, which is something called Happy Eyeballs version three that should make browsing go a little quicker.

Simply, every time Firefox loads a page, it has to pick a path to reach a server, maybe over IPv4, IPv6, maybe HTTP2 or the newer HTTP3.

The older Firefox versions picked one path and waited to see how it worked before trying another.

If that first go was slow or broken, the page just sat there.

I suppose it provides some security implications as well because you can hide a payload inside of the body that doesn't show up in in proxy logs or whatever.

I would say this is the first big change to HTTP other than HTTP2 or HTTP3.

But as far as like this sort of vanilla HTTP, this is the biggest change in quite a long time.

It's not a architecturally...

Plus, GKE Gateway now supports strong cookie affinity for session stickiness in GA. GKE has also changed the priority of some default firewall rules for services from 1,000 to 999, so check your custom rules to make sure nothing gets unexpectedly blocked.

On the service mesh front, Managed Cloud Service Mesh is rolling out a new proxy version that maps closely to Envoy version 137, which resolves HTTP.2 security vulnerabilities.

Also, Cloud Service Mesh version 1.30.4 ASM.1 is now available for in-cluster deployment, while in-cluster version 1.27 is officially no longer supported.

In networking, you can now create Compute Engine instances with multiple virtual network interfaces, or VNICs, within the same VPC network.

excellent well thanks thomas this was once again an interesting thing i'm going to put an article around it as well once we have the recording here done and list to all the resources so people don't have to actually look at the banners that i put in there and uh yeah good luck with that i think it's a it's a great opportunity to think about uh differently and the sizes that we want to store these days.

I mean, we kind of gave up on CDNs for things like jQuery because with HTTP2, it wasn't that much of an issue anymore, and people are not too worried about long...

I mean, performance has changed a lot because people take on a lot more things.

I mean, you can turn you can turn your app from a web app to an ai app just by renaming every loading into thinking and then making people wait that way and we kind of got got used to that one but it's a great opportunity to and i love that it's a that it's a what uh uh wicg uh thing as well and not just a google one so that there's more people involved as well and um yeah once again innovating in public and that's where people can take part in and we need you to actually tell us about what you think about that so take a look at the cross origin storage bits and bobs that thomas has talked about and i want to thank you for bringing it up to me so any last words for people out there

Well, they get into a little more nuance.

They have a- an example here of if there was a new HTTP 2 download service vulnerability.

The classic way to solve that, which, oh, we'll just disable HTTP 2 and fall back to using old HTTP 1.1 until the system is patched.

But that might have, you know, significant application and performance impact, right? It's gonna make everything too slow.

So they're saying a more robust AI-driven network and workload-aware response system might be able to say limit how many concurrent streams each IP address can have.

A simple regex change, and all of a sudden, it's done.

But it does go back to this whole idea of, oh, it's HTTP 1.1 instead of HTTP 2.0.

I know they want HTTP 1.1 to go away, but let's be honest, it's never going to go completely away.

It's going to take a long time.

But it's essentially this realization that these AI-generated security vulnerabilities are coming in at a pace that is just, it's just too much to be able to, to be able to realistically absorb.

I remember about a year and a half ago or so, there was a flurry of vulnerabili- of d- denial of service request, vulb, uh, vulner... denial of ser- denial of service attacks, excuse me, in the HTTP/2 world that, uh, when th- when these came out about a year and a half ago, they sounded at the time like it, like the, like, like the world was gonna end.

You know, like, these were, these were incredibly, you know, like, uh, people couldn't believe how sophisticated these attacks were, and these were all human-reported.

These were all human, you know, like, it was a hu- Like, they were, they were human researchers that found these, and they were, they were essentially the last, the last big human-sourced s- vulnerability crop was the, these ones around HTTP/2.

And people thought the world was gonna end, and these ones that are coming in now from a lot of the AI agents are, like, 10 times deeper than this and 10 times more subtle, and, like, h- humans would never have found most of these.

And they're completely valid.

But ultimately, those attacks don't look like a violation.

They're not a thing that a general purpose pro- like HTTP focused test suite would find, right? They're, they're, the bugs are more shaped like almost using the best parts of the beam against itself in a number of cases.

It uses websockets when available and falls back to server-sent events or long polling, all over HTTP, TCP.

there is no native support for raw tcp sockets or named pipes signalr is expressly designed for client server communication over web-friendly protocols typically between browsers and servers grpc grpc uses http 2 as its transport with each call sent as an http to request a vera persistent connection typically tcp secured with tls On ASP.NET Core it supports standard TCP sockets by default and can be configured for Unix domain sockets or Windows named pipes in same machine scenarios.

Its IPC support has improved recently, but the framework fundamentally assumes a TCP, IP stack or an equivalent transport.

Core WCF Core WCF retains much of the multi-binding flexibility of Classic WCF, THOSM bindings are incomplete.

The gap against MessagePack is what you would expect from a text encoding on a 10 MB binary payload.

SignalR is reasonably efficient for local IPC with binary encoding, but its HTTP-based communication cannot match the latencies of in-memory transports.

GRPC-GRPC was benchmarked in two local modes, HTTP 2 over TCP, one-way average of 26.

7 ms, two-way average of 63.8 ms.