Hacker News new | past | comments | ask | show | jobs | submit login

Add-On topic of what I think is the most important component of a web browser: A timeline of JavaScript Just-In-Time (JIT) engines.

https://egbert.net/blog/tags/jit.html

sorry, last time I checked on March 2022, Google Chrome cannot negotiate for my ChaCha-only TLS website; instead try using a Safari, Brave, Firefox, Edge, Aloha, OnionBrowser, Orion, Links, or Lynx web broswer, to name a few).

Meanwhile it is an ongoing crazy ride just mapping the evolution of WASM (in my next planned blog).




Perhaps send them a pull request to fix it, and see what they say?

I can't really imagine why they wouldn't want to support it... I wonder if it was an oversight rather than a policy decision?


I merely configured the website server TLS protocol to my exacting specs (in cryptographic and network security theatre) and Chrome failed because its client "demands" the non-ChaCha variants despite my TLS server INSISTING "my way or the highway".

Beside, I am quite partial toward Firefox browser so there is little benefit for me to file a report to help Firefox's competitors.


Looking again, your server is rejecting their HELO message. You seem to be using a modern cipher yet requiring a legacy (http/1.1) protocol, which I suspect is the issue. Adding an advertisement for TLS_CHACHA20_POLY1305_SHA256 to every TLS 1.3 handshake worldwide would add a lot of gigabytes of global bandwidth, for support of an awfully unusual configuration. Those 4 bytes in every http request globally probably isn't worth it just for you.

Take a look at this trace [1].

I think it's pretty clear the client is offering a bunch of things, including TLS_CHACHA20_POLY1305_SHA256, and your server just replies 'nah, goodbye'.

Perhaps your server doesn't like the ESNI extension?

[1]: https://pastebin.com/ffP4cPJi


Yes, corporation persons desperately want people to move to http/2 and http/3 for for-profit reasons. They're terrible protocols for human persons though. Phasing out http/1.1 support in chrome/etc means phasing out the ability to host a website that can be visited by someone you don't know without the continued permission from a third party TLS CA.


This guy is already using TLS. The site has already obtained a certificate from a CA. How does http/1.1 or http/2 have anything to do with it?


HTTP/2 and HTTP/3 implementations do not allow you to connect to an IP/domain unless there is CA based TLS. HTTP/1.1 allows both HTTP and HTTPS to coexist. If for some reason the CA based TLS cert is revoked I can always just visit the http site over HTTP/1.1.


Your capture is asking for TLSv1.2. Not willing to support that.

Only TLSv1.3+



JS for browsing is not needed at all and often it's a mistake. It may be ocassionally useful, but it's the least important thing.

(The fact that someone can process data and express self in many ways, even with JS - if he can't do it proper by other means - makes that mistake: that the others shall be forced to access data only the limited way some JS allow - but he could mind that the procesing in between may be not needed at all or disturbing and that there are many other ways to access data which dont't block each other or force as expecting JS does.)


I did a Wireshark capture. It's your server that sends back a TLS alert for handshake failure.

Now, Chrome certainly supports ChaCha20 and Poly1305, but it could be that your server is rejecting some other extensions in Chrome's Client Hello.


This actually sounds like a great way to hide from most of Google's influence; thanks!

edit: My main interest is whether or not this blocks Googlebot.


It's easy enough to block Googlebot... It obeys robots.txt and has a distinctive user agent...


An accidental discovery on my part that came from strengthening my website.

It was never about maximizing my readership, just the ones that know what they are doing.


Your website is broken, not Chrome.


No, my website is not broken, just made not accessible to obsolete browsers.

Your browser is stuck on TLS v1.2, try something that supports TLS v1.3


is it a chromium variant?


Doesn't work on edge. ERR_SSL_VERSION_OR_CIPHER_MISMATCH


That’s a new development.

Only TLSv1.3 is server-supported, am surprised that Edge did a downgrade.


It's still broken in Google Chrome 109 (the latest stable version) on Linux:

> egbert.net uses an unsupported protocol.

> ERR_SSL_VERSION_OR_CIPHER_MISMATCH


which is what I expected given that Google Chrome chose to ignore the server's "my options only or nothing".




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: