Comparing HTTP/3 vs. HTTP/2 Performance (2020)

https://blog.cloudflare.com/http-3-vs-http-2

by luu • 2 years ago

25 28 2 years ago

blog.cloudflare.com

niomarketing• 2 years ago

what's the report about?

loloquwowndueo• 2 years ago

Click the link and find out? :)

superkuh5• 2 years ago

Now compare the performance of HTTP/3 versus HTTP/1.1 over multiple years when the website isn't run by a corporation paying an engineer to babysit and maintain it. The HTTP/3 CA TLS HTTPS-only setup would start failing due to CA TLS problems eventually (in a year or two) while the HTTP/1.1 HTTP+HTTPS would remain accessible forever. This is the core problem with HTTP/3 for human people.

It is one that could be fixed by developers if only the correct flags were set during compilation of the HTTP/3 libs and during their linking to the relevant browsers. But no one seems to care about human use cases. It's corporate security uber alles.

jsheard• 2 years ago

TLS-only servers needing babysitting is mostly a failing of older projects like nginx which leave certificate management as an exercise for the user - newer projects like Caddy and Traefik have shown that for simple deployments it can be made almost completely transparent with automatic ACME provisioning. Caddy can even gracefully handle cases where a certificate is unexpectedly revoked, by provisioning a new one immediately. It really does Just Work™.

saurik3• 2 years ago

I don't know if it handles this unexpected-revocation scenario, but as Apache has had support for automated Let's Encrypt for a while now (I finally upgraded last week, when I realized I was missing out on this feature), I'm surprised that nginx doesn't?

superkuh5• 2 years ago

Newer indeed. Caddy isn't even 10 years old itself yet. I'm not sure how you can be sure it's all-in-one is going to handle long times gracefully. But for short term few to handful of years use cases, sure.

sebazzz• 2 years ago

The HTTP/3 CA TLS HTTPS-only setup would start failing due to CA TLS problems eventually (in a year or two)

Why? And why https with http 1.1 not?

acdha4• 2 years ago

The HTTP/3 CA TLS HTTPS-only setup would start failing due to CA TLS problems eventually (in a year or two) while the HTTP/1.1 HTTP+HTTPS would remain accessible forever

This is nonsense: if you set up Let’s Encrypt or the equivalent, which is increasingly built in, it’ll keep working for HTTP 1-3. If you don’t, you need to rotate certificates for all of them.

If your claim is that the HTTP 1 option is better because you can be insecure after the certificate expires, that’s conflating two separate things and saying that you don’t care about your users privacy and security, which might be true but is a more compelling argument against using that service than against HTTP/2.

superkuh5• 2 years ago

I don't think you quite understood my point.

Like said, HTTP+HTTPS in HTTP/3 would be perfect. Everyone could be happy and websites could have infinite unmaintained lifetimes and anyone could visit without getting approval from a third party corporation every 3 months. But nope, the big tech companies, and even Mozilla, refuse to implement an HTTP/3 that supports HTTP+HTTPS. It's flabberghasting, unless you view it through the lens of the needs of commerce only. That is my point.

*re: This is nonsense: So when I set up lets encrypt using an acme (1) client it should still work today? Oh wait, they dropped acme 1 support entirely and only support acme 2 now (and will again with acme 3). And that's ignoring that whatever acme client you pick is going to have breaking changes too over time (even if it's acme.sh!). Then there's the 2018 LE root cert expiration... then the 2024 one, then there's TLS version sun-setting...). It is not so non-sensical down in the weeds of actually hosting a 90-day cert CA TLS website over more than a few years. And just to note: I love LE. I use LE for some websites. I think it's great. I love HTTPS too. I just think HTTPS-only instead of HTTP+HTTPS is very damaging socially.

spintin2• 2 years ago

This.

The amount of times certificates have run out breaking things is astounding.

So I work around all certificate test the first thing I do when integrating with an external HTTPS site.

Good job people that get paid by HTTPS.

jsnell• 2 years ago

(2020)

mobilemidget2• 2 years ago

I prefer TCP for web traffic rather than UDP.

pgraf• 2 years ago

Care to elaborate?

mobilemidget2• 2 years ago

Many providers limit or block UDP because of the history with DDOS attacks.

spintin2• 2 years ago

Me too, HTTP/1.1 for life.

The performance of these binary protocols does not scale on most server implementations.

The protocol is not the bottleneck, the parallelism and memory latency is.

fmajid• 2 years ago

QUIC/UDP and BBR is mostly a way for Google to grab more than its fair share of bandwidth during congestion, and will lead to a tragedy of the commons where people using less pushy congestion control protocols like CUBIC will be edged away.

londons_explore• 2 years ago

For a small test page of 15KB, HTTP/3 takes an average of 443ms to load

443 milliseconds!! When typical user latency is sub 50 milliseconds, requiring 443 milliseconds to get a lightweight page displayed on the screen is terrible.

Users perceive 100 milliseconds as near-instant, and that ought to be the target. With 50 milliseconds of network latency, and 0-rtt support, that gives 50 milliseconds for server and client processing+rendering. Ought to be very do-able.

The fact it has not been done really is a failure of software engineering as an industry - we always favour more layers of abstraction over perfecting the user experience.

theandrewbailey• 2 years ago

With 50 milliseconds of network latency, and 0-rtt support, that gives 50 milliseconds for server and client processing+rendering. Ought to be very do-able.

You're forgetting DNS lookup latency (could be several sequential lookups), and potential protocol switch from HTTP to HTTPS. Having 0-rtt support doesn't do you any good if you don't know which server to send to.

albertopv• 2 years ago

I'm out of the loop, anyone knows if performance improved aince 2020?

Comparing HTTP/3 vs. HTTP/2 Performance (2020)

Related Stories