TCP alternative QUIC reaches IETF's Standards Track after eight years of evolution
- Reference: 1622440685
- News link: https://www.theregister.co.uk/2021/05/31/quic_becomes_standard/
- Source link:
The [1]QUIC spec , aka RFC 9000, appeared on May 27th, marking the end of the beginning for a story that started in 2013 when Google [2]revealed it was playing with QUIC, which it then described as "an early-stage network protocol we are experimenting with that runs a stream multiplexing protocol over a new flavor of Transport Layer Security (TLS) on top of UDP instead of TCP."
[3]QUIC! IETF sets November deadline for last comments on TCP-killer spawned by Google and Cloudflare
[4]New IETF draft reveals Egyptians invented pyramids to sharpen razor blades
[5]Quic! Head to the latest Chrome version and try out HTTP/3
[6]Internet be nimble, internet be QUIC, Cloudflare shows off new networking shtick
QUIC’s best trick is to allow a client and server to send data, even if they have never connected. Cutting out the extra round trips needed to establish a TCP link means less traffic and faster connections. That’s especially welcome on wireless networks, which are nearly always shared and see contention for resources. Just in case you haven’t noticed, there’s about three billion wireless devices out there on cellular networks, so anything that makes networks behave better for them is welcome by users, network operators, content providers, and plenty of other stakeholders.
Internet-grooming company Cloudflare liked QUIC so much it’s offered it as a service for a few years now. Microsoft has used QUIC to carry SMB traffic and [7]proclaimed it “the future of distributed systems.” True to form, Microsoft has also [8]created its own version of QUIC and open-sourced it.
Google’s already [9]baked QUIC into its Chrome browser and that gives it a presence on hundreds of millions of devices.
[10]
[11]
But QUIC has not been widely adopted elsewhere. A Cloudflare [12]post celebrating QUIC’s ascension to the standard track says it can detect “around 12% of Internet traffic using QUIC with HTTP/3”.
QUIC’s new status has seen Cloudflare take its QUIC service out of beta and offer it to all comers, in the hope of making it more prevalent.
It’s hard to argue against anything that speeds networks. But be careful what you wish for, because in January 2021 networking boffins [13]rated QUIC as more vulnerable to web fingerprinting than HTTPS, a technology QUIC was intended to supplant. ®
Get our [14]Tech Resources
[1] https://datatracker.ietf.org/doc/html/rfc9000
[2] https://www.theregister.com/2013/07/10/http_20_ietf_draft_lands/
[3] https://www.theregister.com/2020/10/26/quic_last_call_ietf/
[4] https://www.theregister.com/2021/05/20/new_ietf_draft_reveals_egyptians/
[5] https://www.theregister.com/2019/09/26/quic_head_to_the_latest_chrome_version_and_try_out_http3/
[6] https://www.theregister.com/2018/09/25/cloudflare_quic_protocol/
[7] https://www.theregister.com/2020/11/02/windows_server_futures/
[8] https://www.theregister.com/2020/05/04/microsoft_reveals_msquic_quic_implementation/
[9] https://www.theregister.com/2019/09/26/quic_head_to_the_latest_chrome_version_and_try_out_http3/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YLSzuV-jhnwoTm150nChTAAAAIU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YLSzuV-jhnwoTm150nChTAAAAIU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://blog.cloudflare.com/quic-version-1-is-live-on-cloudflare/
[13] https://www.theregister.com/2021/01/30/quic_fingerprinting_flaw/
[14] https://whitepapers.theregister.com/
Everything old is new again. Each generation reinvents the same parts of the same wheel using new vocabulary and a modern color. Next up we'd have computers talking to each other as a new fashion thing.
"Human: Computer, where is my computer? Computer: You have me in your pocket."
12 year loop
Several years ago I wrote a short piece on an observed feature in the industry I was working in (oil&gas exploration). It was prompted by a presentation at a big conference showing a new way of improving project management - a technique I’d been using some 15 years earlier.
I noticed that, in many of the major project management organisations, few people stayed in a post for more than 5 years, many no more than 3. I has also been able to observe staff hangovers in a hospital ward for a couple of years (a family member with a long term stay - now out and about). There were 3 shifts in the ward and I noticed a number of times where the handover meetings missed something (fortunately not life-threatening, but still a concern). I compared this to the offshore regime where there are only 2 shifts. In the latter, you are usually handing over to the person who handed over to you; this didn’t happen in the former, and missed items (fortunately very few) were in the second handover. I put this down to the fact that the second shift, whilst aware of something, didn’t own the issue and wouldn’t put the same importance on it; consequently, they wouldn’t put the same emphasis on it. The saving grace was that most points didn’t become significant until it got to the third shift (who were already aware of it).
Now apply this to the corporate situation where a problem arises and is solved. The situation (problem and solution) is passed onto the next generation but, when it comes to the one after that, the reason for the solution is lost and the problem comes back. After all, it often came about because it was the easier way and the solution needed a bit extra.
Taking an average of 4 years in post, we shouldn’t be surprised when wheels start getting reinvented after 12 years…. I called it by a made-up word: hystery.
Re: 12 year loop
Staff hangovers? Love it.
networking boffins rated QUIC as more vulnerable to web fingerprinting than HTTPS
I am also concerned about packet injection, impersonation, and other such security issues
TCP at least TRIES to make packet injection and impersonation difficult.
Re: networking boffins rated QUIC as more vulnerable to web fingerprinting than HTTPS
You should read the actual RFCs. It's clear you haven't understood any of it.
TCP does exactly nothing to prevent packet injection. Anyone in the route can swap a few packets if they feel like it, and there's no way for the other end to detect it. An application can only defend against those attacks by layering security on top of the stream - usually TLS.
QUIC requires TLS.
The only way to spoof QUIC packets is to break the encryption or poison the certificate chain. Not impossible of course, but no less difficult than breaking HTTPS.
QUIC’s best trick is to allow a client and server to send data, even if they have never connected.
Just like X.25's "fast select" from the 1970s?