top | item 45565646

HTTP3 Explained

192 points| weinzierl | 5 months ago |http3-explained.haxx.se | reply

77 comments

order
[+] akdor1154|5 months ago|reply
Damn it's nice reading a simple static site like this. Links open instantly to the next fully laid out page of content. If only the rest of the web could be like this..
[+] madeofpalk|5 months ago|reply
Worth nothing, that react application (using React Server Components?)! If you have javascript enabled, it renders as a single page app, fetching each additional page via an API. If you disable JS, it renders it all on the server.
[+] INTPenis|5 months ago|reply
Agreed but where is the actual git repo? I see a text saying this "contents get updated automatically on every commit to this git repository" but where is "this git repository"?

I can't find a link to the source anywhere.

[+] fkyoureadthedoc|5 months ago|reply
Damn it's nice to log onto Hacker News and see yet another top comment on an interesting article be bike shedding about webshit. And also wrong because if you crack open your react dev tools and have a peak inside the 2MB of javascript you'll see that this site is still everything you despise.
[+] thegrim33|5 months ago|reply
I see literally two dozen JS scripts run when I open the page.
[+] Nifty3929|5 months ago|reply
+1000

I need fancy javascript crap like I need a hole in my head.

[+] Razengan|5 months ago|reply
But how will the author know the last 500 websites you visited and where your eyes are looking right now and what you ate last Tuesday? They should put some AnAlYtIcS in.
[+] sedatk|5 months ago|reply
The document is now five years old and full of statements like “we’ll see that in the upcoming years”. I think it’s due for an update.
[+] lsaferite|5 months ago|reply
I was personally bugged by it claiming that QUIC wasn't an acronym.
[+] code_martial|5 months ago|reply
Here’s a conceptual background about how and why HTTP/3 came to be (recollected from memory):

HTTP/1.0 was built primarily as a textual request-response protocol over the very suitable TCP protocol which guaranteed reliable byte stream semantics. The usual pattern was to use a TCP connection to exchange a request and response pair.

As websites grew more complex, a web page was no longer just one document but a collection of resources stitched together into a main document. Many of these resources came from the same source, so HTTP/1.1 came along with one main optimisation — the ability to reuse a connection for multiple resources using Keep Alive semantics.

This was important because TCP connections and TLS (nee SSL) took many round-trips to get established and transmitting at optimal speed. Latency is one thing that cannot be optimised by adding more hardware because it’s a function of physical distance and network topology.

HTTP/2 came along as a way to improve performance for dynamic applications that were relying more and more on continuous bi-directional data exchange and not just one-and-done resource downloads. Two of its biggest advancements were faster (fewer round-trips) TLS negotiation and the concept of multiple streams over the same TCP connection.

HTTP/2 fixed pretty much everything that could be fixed with HTTP performance and semantics for contemporary connected applications but it was still a protocol that worked over TCP. TCP is really good when you have a generally stable physical network (think wired connections) but it performs really badly with frequent interruptions (think Wi-Fi with handoffs and mobile networks).

Besides the issues with connection reestablishment, there was also the challenge of “head of the line blocking” — since TCP has no awareness of multiplexed HTTP/2 streams, it blocks everything if a packet is dropped, instead of blocking only the stream to which the packet belonged. This renders HTTP/2 multiplexing a lot less effective.

In parallel with HTTP/2, work was also being done to optimise the network connection experience for devices on mobile and wireless networks. The outcome was QUIC — another L4 protocol over UDP (which itself is barebones enough to be nicknamed “the null protocol”). Unlike TCP, UDP just tosses data packets between endpoints without much consideration of their fate or the connection state.

QUIC’s main innovation is to integrate encryption into the transport layer and elevate connection semantics to the application space, and allow for the connection state to live at the endpoints rather than in the transport components. This allows retaining context as devices migrate between access points and cellular towers.

So HTTP/3? Well, one way to think about it is that it is HTTP/2 semantics over QUIC transport. So you get excellent latency characteristics over frequently interrupted networks and you get true stream multiplexing semantics because QUIC doesn’t try to enforce delivery order or any such thing.

Is HTTP/3 the default option going forward? Maybe not until we get the level of support that TCP enjoys at the hardware level. Currently, managing connection state in application software means that over controlled environments (like E-W communications within a data centre), HTTP/3 may not have as good a throughput as HTTP/2.

[+] newpavlov|5 months ago|reply
Thank you for a great overview! I wish HTTP3/QUIC was the "default option" and had much wider adoption.

Unfortunately, software implementations of QUIC suffer from dealing with UDP directly. Every UDP packet involves one syscall, which is relatively expensive in modern times. And accounting for MTU further makes the situation ~64 times worse.

In-kernel implementations and/or io-uring may improve this unfortunate situation, but today in practice it's hard to achieve the same throughput as with plain TCP. I also vaguely remember that QUIC makes load-balancing more challenging for ISPs, since they can not distinguish individual streams as with TCP.

Finally, QUIC arrived a bit too late and it gets blocked in some jurisdictions (e.g. Russia) and corporate environments similarly to ESNI.

[+] NeutralForest|5 months ago|reply
Thanks for taking the time to make this, that was helpful!
[+] vivzkestrel|5 months ago|reply
stupid question: why do we need QUIC? why not just switch HTTP to UDP instead of TCP?
[+] sebazzz|5 months ago|reply
I also have em-dashes in memory.
[+] kevg123|5 months ago|reply
> As the packet loss rate increases, HTTP/2 performs less and less well. At 2% packet loss (which is a terrible network quality, mind you), tests have proven that HTTP/1 users are usually better off - because they typically have up to six TCP connections to distribute lost packets over. This means for every lost packet the other connections can still continue.

Why doesn't HTTP/2 use more than one socket?

[+] thwarted|5 months ago|reply
Because one thing it tries to optimize for is avoiding TLS session negotiation.
[+] derelicta|5 months ago|reply
It's still crazy how quickly http3 got adopted by web actors. Can't wait til we do the same for IMAP and SMTP
[+] immibis|5 months ago|reply
Email is mostly dead - we use Gmail (or Microsoft 365) now. It is to email what Slack is to IRC. With only one or two vendors, the need for widely interoperable protocols is gone - they only need to interoperate between a few large service providers, and that can be done by private agreement.
[+] sharts|5 months ago|reply
Will there be HTTP/4 ?
[+] ahoka|5 months ago|reply
Anyone else blocks UDP 80/443 due to privacy concerns?
[+] detaro|5 months ago|reply
What privacy concern do you have that does not apply to TCP 80/443?
[+] frmdstryr|5 months ago|reply
Yes, no performance difference either.
[+] ckbkr10|5 months ago|reply
Sounds overly complicated, I doubt this will have a widespread adoption