Mark Nottingham

First, there is a major difference between the component (e.g. the software package) and the connectors (e.g. APIs). It makes sense to talk about versioning at the component level, but it should rarely apply at the API level. See this excellent article for further clarification: https://www.mnot.net/blog/2011/10/25/web_api_versioning_smackdown.

Versioning an API is a decision by the API provider to let the consumer deal with forward and backward compatibility issues. I prefer the approach of focusing on the link relations or media type vice URI or some other technique of versioning because it is consistent in the direction (wrt Hypermedia-based APIs) of the link relations as the point-of-coupling for your API, which makes managing and reasoning about changes to your API less complicated.

Whenever possible, hypermedia-based media type designers should use the technique of extending to make modifications to a media type design. Extending a media type design means supporting compatibility. In other words, changes in the media type can be accomplished without causing crashes or misbehavior in existing client or server implementations. There are two forms of compatibility to consider when extending a media type: forward and backward.

Forward-compatible design changes are ones that are safe to add to the media type without adversely affecting previously existing implementations. Backward-compatible changes are ones that are safe to add to the media type design without…

> CDNs are an architectural misfeature that only exist because Fly.io wasn't around 20 years ago. I'm being extreme, but I think that's fundamentally true. ;)

Spicy take :) Although building for a dynamic CDN (I'm thinking Varnish here) feels like building inside-out, I can't see a way to deliver pageviews as efficiently (in terms of CPU or Watts per view) without using a CDN and a lot of caching.

With Fly I guess you flip the architecture around and run code but cache a lot of partials that you assemble together. Nicer than working with ESI and its "cache it all but punch holes in the page and render those bits again" approach, but does the efficiency hold up?

My architectural misfeature would be ESI [1,2]. So useful and so painful to use. And that's before we get to varying support in different proxies and caches...

1. https://www.mnot.net/blog/2011/10/21/why_esi_is_still_important_and_how_to_make_it_better

2. https://twitter.com/peterbowyer/status/1366324396026118149

Right, my spidey senses were tingling, too. So I looked into the RFC's author, and noted his position as one of the champions of QUIC as HTTP/3, and his promotion of encrypted DNS (specifically DoH), and then an interesting article that on the surface sounds like it advocates for ensuring end users retain control of their DNS requests, but which actually advocates for burying the implementation of DNS in the OS and only exposing a control layer to the end user (e.g. an on/off toggle). [0] I can't pretend to have enumerated all the possible ramifications of this, but without more than a couple of paragraphs in an RFC which is essentially one particular example use case, I consider this a fairly suspicious addition to the URI spec specifically, when viewed in the context of how this might be used to obscure URLs (a subset of URI) from end users (and software running on end user machines).

[0] https://www.mnot.net/blog/2019/06/11/endpoint_control

It's so cool to have this split. QUIC is so capable, such a neat set of ideas for a transport. That HTTP can express itself in terms of another spec is one of the most compelling, longest-hardest won & best victories for "abstraction" that computing has seen. That we'll be able to iterate on HTTP in new ways, by having a common semantic base, keeps the future open & iterable. Huge wins.

Obligatory link to Mark Nottingham's "A New Definition of HTTP3"[1], which talks about the split of HTTP into a semantic definition in RFC9110[2] & the creation of HTTP2/RFC9113 and HTTP3 (over QUIC, this document).

[1] https://www.mnot.net/blog/2022/06/06/http-core https://news.ycombinator.com/item?id=31647149 (3 points, 26m ago, 0 comments)

[2] "HTTP Semantics" https://www.rfc-editor.org/rfc/rfc9110

[3] "HTTP2" https://www.rfc-editor.org/rfc/rfc9113

Identifiers like URIs are persistent, but the representations it provides you are not persistent over time.

So, if I provide a URI that means "a list of links to various resources with interesting data", those linked URIs can be bookmarked (they're persistent), but the original URI has every right to change the links later on if it thinks there are more relevant ones (e.g. newer, more relevant, etc.). Think of how a news site's main page changes with "Top News Stories", for example. That doesn't mean the older URIs it pointed yesterday to are necessarily bad.

For a RESTful machine-to-machine interface, this HATEOS approach is arguably one of the more effective ways to do extensibility and versioning: http://www.mnot.net/blog/2011/10/25/web_api_versioning_smackdown

It requires a more modern browser to operate securely; it says nothing about whether it is perfectly secure against all threat models, and this particular website is hosted on the same IP as at least one other so requires SNI to operate securely indeed, and will hopefully in future support ESNI as the software implements it.

BTW - if this site did not use SNI, and only served one website at https://www.mnot.net, then connecting to www.mnot.net's IP address at port 443 would be plenty good evidence that you're accessing https://www.mnot.net. The SNI privacy leak only really comes into play when you're accessing something behind a CDN or a shared hosting provider, which put enough sites behind each IP that simply accessing that IP isn't a privacy leak in itself.