4 ms·
I was surprised to read that as well. I have gzip compression "turned on" in all of the nginx servers I administered. Didn't even know it could be an attack vec
by reacharavindh 8y ago
I was surprised to read that as well. I have gzip compression "turned on" in all of the nginx servers I administered. Didn't even know it could be an attack vector.
https://www.acunetix.com/vulnerabilities/web/crime-ssl-tls-attack/ https://www.acunetix.com/vulnerabilities/web/crime-ssl-tls-a...
- ktpsns 8y agoWhat's probably worth saying is that (at least for Apache), you can enable compression only for certain file types, such as static text files (HTML/CSS/JS) but not dynamic files (thinking of classical CGI scripting -- PHP/Python/Ruby). It should be possible to seperate this also for modern-world fcgi services. How does HTTP2 and HTTP3 perform in this question? I always percieved deflate/gzip compression as something preferable. I never realized the CRIME attack before.