4 ms·

This attitude is completely irresponsible. HTTPS will ensure integrity of your download automatically with no action required from the user. Checksums require

This attitude is completely irresponsible. HTTPS will ensure integrity of your download automatically with no action required from the user. Checksums require the user to perform the integrity check manually, and 99.9% of users wont bother. Please don't put your users at risk just to save a negligibly small number of CPU cycles.

ikeboy 11y ago
Granted, the project I saw this reasoning on (https://www.whonix.org/wiki/Download_Security https://www.whonix.org/wiki/Download_Security) is one where users are especially likely to do security checks, and they generally aren't satisfied with the security of SSL anyway. > just to save a negligibly small number of CPU cycles The link above says they can't afford the additional cost. If it's so negligible, would you sponder the cost of those extra cycles? I'm sure they would host on SSL if someone covered the cost.
- nmjohn 11y ago
  Quote from a google engineer in 2010 (it's only gotten cheaper in the last 6 years w/ advances in CPU tech) regarding SSL overhead: > On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that. [0] [0]: https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
  - ikeboy 11y ago
    None of affects the point they're making, which is that they can't find SSL mirrors that aren't more expensive. If you find one, let them know and I'm sure they'll be happy to switch over.
    - owaislone 11y ago
      It is 2016. SSL is not slow anymore. Only case it could be deemed slow would be on a webpage where the browser has to download a ton of small files likes images. Each image would require a new connection and each connection would require full SSL handshake. Even then the fix is not to not use SSL but to bundle all the images/files into 1.
      - x0 11y ago
        Maybe not computationally, but if you're 100ms, 200ms, 300ms or more away from the rest of the internet, all the SSL handshakes really add up.
        nmjohn 11y ago
        Keep in mind the topic at hand is downloading a single large file, the TLS handshake is a rounding error of the total time, regardless of where you are in the world.
    - deleted 11y ago
      [deleted]

ikeboy 11y ago

Granted, the project I saw this reasoning on (https://www.whonix.org/wiki/Download_Security https://www.whonix.org/wiki/Download_Security) is one where users are especially likely to do security checks, and they generally aren't satisfied with the security of SSL anyway. > just to save a negligibly small number of CPU cycles The link above says they can't afford the additional cost. If it's so negligible, would you sponder the cost of those extra cycles? I'm sure they would host on SSL if someone covered the cost.

nmjohn 11y ago
Quote from a google engineer in 2010 (it's only gotten cheaper in the last 6 years w/ advances in CPU tech) regarding SSL overhead: > On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that. [0] [0]: https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
- ikeboy 11y ago
  None of affects the point they're making, which is that they can't find SSL mirrors that aren't more expensive. If you find one, let them know and I'm sure they'll be happy to switch over.
  - owaislone 11y ago
    It is 2016. SSL is not slow anymore. Only case it could be deemed slow would be on a webpage where the browser has to download a ton of small files likes images. Each image would require a new connection and each connection would require full SSL handshake. Even then the fix is not to not use SSL but to bundle all the images/files into 1.
    - x0 11y ago
      Maybe not computationally, but if you're 100ms, 200ms, 300ms or more away from the rest of the internet, all the SSL handshakes really add up.
      - nmjohn 11y ago
        Keep in mind the topic at hand is downloading a single large file, the TLS handshake is a rounding error of the total time, regardless of where you are in the world.
  - deleted 11y ago
    [deleted]