Subject: Re: [httpwg/http-extensions] Request header for Expect-CT (#317)

From: HTTP issue updates <[email-masked]>
Date: Mon, 03 Apr 2017 12:07:38 -0700

This would require including it in `Vary` on cacheable responses -- something that is going to reduce cache efficiency and also likely to cause operator error.

Is the added complexity/risk worth it?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-291242679

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 03 Apr 2017 12:59:03 -0700

Also, I expect Expect-CT to be a somewhat niche feature, so we'd probably be adding wasted bytes to the vast majority of requests.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-291256047

---

From: HTTP issue updates <[email-masked]>
Date: Wed, 05 Apr 2017 16:15:28 -0700

i imagine HPACK would compress that out. Without this, is there a way we can deprecate this header from ever being sent by a server? User agent hints?

@mnot do we really need to add it on Vary? Clients who get responses with this header and don't support Expect-CT will just ignore it.  Clients who get this but have not sent Expect-CT will ignore it. Clients who have deprecated Expect-CT will behave like clients who don't support Expect-CT.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-292024023

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 06 Apr 2017 21:56:59 -0700

HPACK does not give infinite efficiency; we're already hearing about the dynamic table thrashing for some sites.

If you don't put it in Vary, then an intermediary cache will store the version without the `Expect-CT` hint and serve it to clients that could have used one.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-292438597

---

From: HTTP issue updates <[email-masked]>
Date: Fri, 14 Apr 2017 17:29:43 -0700

@siyengar I think that servers could probably just look at User-Agents to determine when the header is no longer applicable for most of the clients contacting them. (I imagine they'll probably end up wanting to keep an eye on the CT policies for the UAs they care about anyway, because the server might not get any value out of Expect-CT even if the UA still supports it. For example, one could imagine a UA that fully requires CT for all certs, but still supports Expect-CT for reporting purposes, in which case a server that is not using reporting would want to not send Expect-CT even though the UA still advertises support for it.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-294260505

---

From: HTTP issue updates <[email-masked]>
Date: Sun, 16 Apr 2017 21:02:09 -0700

@mnot @estark37 the same problem would occur if the server decides not to send Expect-CT based on UA. Either you send the header to everyone, or if you don't send it to everyone, you have to include a Vary: User-Agent instead of a Vary: Expect-CT. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-294400966

---

From: HTTP issue updates <[email-masked]>
Date: Sun, 16 Apr 2017 21:21:52 -0700

@siyengar I just meant that if a server knows (from looking at UA) that 99.9% of its clients are Browsers X, Y, and Z, then it can stop sending Expect-CT when Browsers X, Y, and Z no longer support Expect-CT.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-294402406

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 17 Apr 2017 01:59:18 -0700

@estark37 - in that case, it would need to include "User-Agent" in the "Vary" field value....

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-294435651

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 17 Apr 2017 04:11:47 -0700

as Emily says, this is a niche server feature. The global number of bytes
spent advertising to sites unaware of CT is going to be way more than the
number of bytes sent bearing the response header. It can be deprecated just
as easily by watching market share counters as anything else. I would close
the issue wontfix personally.

as a total aside - the hpack pressure is normally on the server table not
the client one, right?

On Mon, Apr 17, 2017 at 4:59 PM, Julian Reschke <[email-masked]>
wrote:

> @estark37 <https://github.com/estark37> - in that case, it would need to
> include "User-Agent" in the "Vary" field value....
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/httpwg/http-extensions/issues/317#issuecomment-294435651>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AAP5sxJDxivobMDEHp4bulsjDszXx9Erks5rwynlgaJpZM4MvwJh>
> .
>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-294456283

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 17 Apr 2017 18:38:10 -0700

@mcmanus that's fair. We can always set Vary: User-Agent if we want to set it for some UAs but not others. It's clunky, but doable.
@estark37 I think I'm fine with this rationale and we can close this out.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-294647000

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 17 Apr 2017 18:45:38 -0700

Personally - I agree with @estark37 and @mcmanus. There's no need to advertise it in `Vary` if the server makes a decision about turning it on/off for **all** requests. That approach is more suitable to this situation IMO.

WRT hpack pressure -- numbers are always interesting, of course, but I'm hearing a lot of people on both sides making proposals with the assumption that hpack will take care of their efficiency problems. That's true, but only to a certain point...

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-294648356

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 17 Apr 2017 19:05:39 -0700

Closed #317.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#event-1045856429

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 17 Apr 2017 19:05:40 -0700

Thanks for the input, everyone.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/317#issuecomment-294651147