Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It seems to me this could also be an advantage for websites which want to make themself inaccessible in these circumstances. An enterprise which firewalls things so only port 443 is allowed out is also more likely to do corporate MitM of all traffic. Historically I was definitely annoyed that browsers chose to make custom root CAs an implicit exemption from HPKP (even if HPKP is now history). I'd certainly consider DoSing my own site under likely MitM conditions. Using a different port also makes it harder for organisations to successfully do this kind of filtering in the future if it becomes widespread.

Another advantage is to prevent other kinds of blocking, which are based on blacklisting specific ports rather than only allowing port 443. Many residential ISPs and even hosting providers now engage in the flagrant net neutrality violation of blocking port 25; if use of SVCB records became common to allow a different port to be used, it would let other ports be used for site-to-site email, allowing email domains to contribute to rendering this blocking ineffective. Of course I'm not aware of any plan to adopt SVCB for email yet. But TBQH as someone who's always lamented the Internet's lack of a decent service lookup mechanism and the limitations (and lack of adoption) of SRV records, I'd like to see SVCB adopted for pretty much everything in future.

Fundamentally the use of well known ports was always a mistake, and really was just a crutch which was entirely the product of the internet's lack of any real service discovery mechanism, aside from the late, extremely underused and very limited DNS SRV mechanism. Ports are a mere implementation/routing detail and should not have any semantic meaning whatsoever. The time when organisations can do port-based filtering is coming to an end, fortunately. (Even if they do continue with it, the ability to now move practically everything to port 443 makes it increasingly meaningless in terms of achieving whatever they thought they were hoping to achieve.)



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: