Moving forward on improving HTTP's security
Wow, are they going about this entirely wrong?You don't screw around with the standard to try to drive adoption of encryption. You should solve a user interface problem by improving the user interface, right?It's also not about getting an SSL cert. If you're doing anything interesting at all, you need an SSL cert, even if only for some percentage of your population. You also do need decent ways for people to distribute keys to their devices.But at the end of the day, it's the green light/red light which is going to drive user adoption. The browser which capitalizes on privacy features and presents them best is a huge winner over the next 5 years.Ultimately people should get the level of security they ask for. I don't think the spec should be catering to users who don't even know that http must die and https is the only way forward. Nothing could be more obviously true.What's not obvious is the adoption rate once HTTP2 is baked. What the spec should be contemplating is how they can get the best roll out. There are so many awesome features we want to start being able to rely on, but if the new stack isn't pervasive, some people will think it's hard to justify coding for it.