4 ms·
Doing HTTP separately from TLS in 2016 isn't doing "one thing" well, it's doing "half a thing." If you're serving HTTPS to clients and your backends are also H
by CrLf 10y ago
Doing HTTP separately from TLS in 2016 isn't doing "one thing" well, it's doing "half a thing."
If you're serving HTTPS to clients and your backends are also HTTPS, you quickly get into a mess of extra components opening unnecessary sockets around just to do TLS.
- olavgg 10y agoPHK has argued that the SSL/TLS libraries we have is a nightmare when it comes security design. He rather favor "jailing" these processes as a separate process. So if hell breaks lose, like with Heartbleed, your Varnish process should still be "safe".
- CrLf 10y agoI agree. But that doesn't require showing that separation to users. Varnish could internally separate TLS from the rest while still behaving as a single service.