7 ms·

> Netflix send petabytes of data over HTTPS. There's no excuse for anyone else. Uhh, yes, indeed... manufacturing cars is so cheap these days, even General Mot

> Netflix send petabytes of data over HTTPS. There's no excuse for anyone else. Uhh, yes, indeed... manufacturing cars is so cheap these days, even General Motors can do it... > That's not the case. HTTPS encrypts all headers. That's not the case. HTTP uses SNI (for now): https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication

MaxBarraclough 7y ago
> manufacturing cars is so cheap these days, even General Motors can do it... Short answer: empirically, there's no question: HTTPS CPU overheads simply aren't a problem [0]. Long answer: that's disanalogous. Manufacturing works with economy of scale. Netflix have it worse than the rest of us. They have to deliver tens of gigabytes per month per customer, using roughly the same hardware as the rest of us. According to that Ars Technica article, they did their usual Netflix-ey software optimisations with FreeBSD, but their hardware isn't customised for the job. Their scale doesn't much help them. If HTTPS overheads would put anyone out of business, it would be Netflix, but here we are: they voluntarily added HTTPS for their streams. Again, as I think it bears stressing: these guys are transmitting about 15% of all data-flow across the Internet. Out of all the HTTPS traffic in the entire world (measured by gigabytes, admittedly discounting number of connections established), Netflix handles at least 15% of it. They do so voluntarily. Same goes for YouTube. If you can think of a business model where HTTPS overheads would cause more trouble than they do for Netflix and YouTube, I'd like to hear it. > That's not the case. HTTP uses SNI (for now) Thanks, I wasn't aware of SNI. I don't think it gives much more away though, does it? Someone spying on my line can already see the IP address I'm connecting to. They already know I'm connecting to Wikipedia. They still can't see the specific page I'm requesting. SNI only leaks information where multiple sites are hosted on the same public IP, right? [0] https://www.keycdn.com/blog/https-performance-overhead https://www.keycdn.com/blog/https-performance-overhead
- bencollier49 7y ago
  > Short answer: empirically, there's no question: HTTPS CPU overheads simply aren't a problem [0]. That's incorrect. Plenty of people browse the net on Z80 based machines. HTTPS borks that, the computers aren't fast enough to run the decryption. There are a lot of assumptions being made in this conversation which may be quite inaccurate.
  - zozbot234 7y ago
    SSL/TLS is a problem even on 80586-class machines (souped up 486's, not Intel Pentiums) - there's a few YT videos showing how long it takes to bootstrap a modern SSH session on that sort of hardware. But honestly, how many people are browsing the net on stuff like that, much less Z80's?
  - eropple 7y ago
    How many people is that "plenty"? More or less than one out of a million? I'd bet hard on "less", and that every single one of them does it by choice.

MaxBarraclough 7y ago

> manufacturing cars is so cheap these days, even General Motors can do it... Short answer: empirically, there's no question: HTTPS CPU overheads simply aren't a problem [0]. Long answer: that's disanalogous. Manufacturing works with economy of scale. Netflix have it worse than the rest of us. They have to deliver tens of gigabytes per month per customer, using roughly the same hardware as the rest of us. According to that Ars Technica article, they did their usual Netflix-ey software optimisations with FreeBSD, but their hardware isn't customised for the job. Their scale doesn't much help them. If HTTPS overheads would put anyone out of business, it would be Netflix, but here we are: they voluntarily added HTTPS for their streams. Again, as I think it bears stressing: these guys are transmitting about 15% of all data-flow across the Internet. Out of all the HTTPS traffic in the entire world (measured by gigabytes, admittedly discounting number of connections established), Netflix handles at least 15% of it. They do so voluntarily. Same goes for YouTube. If you can think of a business model where HTTPS overheads would cause more trouble than they do for Netflix and YouTube, I'd like to hear it. > That's not the case. HTTP uses SNI (for now) Thanks, I wasn't aware of SNI. I don't think it gives much more away though, does it? Someone spying on my line can already see the IP address I'm connecting to. They already know I'm connecting to Wikipedia. They still can't see the specific page I'm requesting. SNI only leaks information where multiple sites are hosted on the same public IP, right? [0] https://www.keycdn.com/blog/https-performance-overhead https://www.keycdn.com/blog/https-performance-overhead

bencollier49 7y ago
> Short answer: empirically, there's no question: HTTPS CPU overheads simply aren't a problem [0]. That's incorrect. Plenty of people browse the net on Z80 based machines. HTTPS borks that, the computers aren't fast enough to run the decryption. There are a lot of assumptions being made in this conversation which may be quite inaccurate.
- zozbot234 7y ago
  SSL/TLS is a problem even on 80586-class machines (souped up 486's, not Intel Pentiums) - there's a few YT videos showing how long it takes to bootstrap a modern SSH session on that sort of hardware. But honestly, how many people are browsing the net on stuff like that, much less Z80's?
- eropple 7y ago
  How many people is that "plenty"? More or less than one out of a million? I'd bet hard on "less", and that every single one of them does it by choice.