4 ms·

I should clarify the performance issue. A lot of developers, even today, come to me asking for a server configured to run a specific directory over SSL, with t

I should clarify the performance issue. A lot of developers, even today, come to me asking for a server configured to run a specific directory over SSL, with the rest of the site over plaintext. The argument I am always given is that SSL will tax the CPU and the site won't be able to scale. I'm told it's a best practice and people will viciously defend "wasting" performance on parts of the site that don't need it. It's not a common recommendation here, where people are arguably more aware of modern practices. But amongst a lot of the population of entry level web developers I run into, it's a very common one, and it's also very wrong. The "round trip" issue however that you point to, is totally valid, but also one that will not kill a site's ability to scale.

toast0 11y ago
TLS absolutely does tax the CPU. Netflix published a paper [1] about the work they did to scale TLS in their cache appliances; after their work, they were able to get 10Gbps of https traffic out of a system that was previously limited by its network interfaces to serving 40Gbps of http traffic. That certainly doesn't apply to everyone, a lot of people are using more CPU to generate their content than to serve it; in that case, maybe adding some extra CPU to encrypt isn't going to have a big effect. Extra round trips can also affect the ability to scale: you'll need to be able to handle more connections open at a time, since each one will take longer to get the request to you. This is probably minor, unless you're on the edge of the number of connections your system can handle. [1] https://people.freebsd.org/~rrs/asiabsd_2015_tls.pdf https://people.freebsd.org/~rrs/asiabsd_2015_tls.pdf