4 ms·

SPDY doesn't provide a way to proxy-cache public assets, so it's bad for places that use such caching to mitigate low bandwidth / high latency connections.

magicalist 15y ago
which is to be expected with a TLS connection. OTOH you get to drop all the extra TCP handshakes, you get better congestion control, you get header compression, and that encrypted connection is often a really good thing. http://bitsup.blogspot.com/2011/09/spdy-what-i-like-about-you.html http://bitsup.blogspot.com/2011/09/spdy-what-i-like-about-yo... But yes, there remains no silver bullet, and you'll have to pick the right tool for the job.
- eggnet 15y ago
  Forcing the use of TLS for SPDY seems to have been intentionally crippling.
  - JoshTriplett 15y ago
    Why should a new protocol offer the option to operate insecurely? Nothing stops a proxy from handling SPDY, if the client trusts it to do so and doesn't mind getting MITMed.
    - eggnet 15y ago
      Transparent caching is part of what makes http so great. Security is relative, you can authenticate content without encrypting it, if there is nothing sensitive about the content. The authentication can happen external to the http or spdy transaction as well.
      - JoshTriplett 15y ago
        > you can authenticate content without encrypting it True, but insecure HTTP provides neither authentication nor encryption. > if there is nothing sensitive about the content. Encrypting only sensitive content leaks information to observers and attackers, namely when you transmit sensitive content, and which servers you connect to when you do so. Encrypting all content eliminates that information leak.
yusufg 15y ago
Wouldn't this be solved by sending a Cache-Control: public, max-age=<long-duration-in-seconds> header so that the assets can be stored in ISP proxy caches as well as browsers on-disk caches
- mcpherrinm 15y ago
  The problem is that ISP caches are essentially impossible with SPDY, because of mandatory TLS.
  - JoshTriplett 15y ago
    I'd consider that a feature, not a bug. Transparent proxies considered harmful, especially when done without informing their users. A SPDY client that trusts a particular proxy could easily allow that proxy to operate on its behalf, and SPDY would actually make that far more efficient.
wmf 15y ago
It looks like SPDY will/could support proxies: http://www.chromium.org/spdy/spdy-proxy http://www.chromium.org/spdy/spdy-proxy http://dev.chromium.org/spdy/spdy-proxy-examples http://dev.chromium.org/spdy/spdy-proxy-examples

magicalist 15y ago

which is to be expected with a TLS connection. OTOH you get to drop all the extra TCP handshakes, you get better congestion control, you get header compression, and that encrypted connection is often a really good thing. http://bitsup.blogspot.com/2011/09/spdy-what-i-like-about-you.html http://bitsup.blogspot.com/2011/09/spdy-what-i-like-about-yo... But yes, there remains no silver bullet, and you'll have to pick the right tool for the job.

eggnet 15y ago
Forcing the use of TLS for SPDY seems to have been intentionally crippling.
- JoshTriplett 15y ago
  Why should a new protocol offer the option to operate insecurely? Nothing stops a proxy from handling SPDY, if the client trusts it to do so and doesn't mind getting MITMed.
  - eggnet 15y ago
    Transparent caching is part of what makes http so great. Security is relative, you can authenticate content without encrypting it, if there is nothing sensitive about the content. The authentication can happen external to the http or spdy transaction as well.
    - JoshTriplett 15y ago
      > you can authenticate content without encrypting it True, but insecure HTTP provides neither authentication nor encryption. > if there is nothing sensitive about the content. Encrypting only sensitive content leaks information to observers and attackers, namely when you transmit sensitive content, and which servers you connect to when you do so. Encrypting all content eliminates that information leak.

yusufg 15y ago

Wouldn't this be solved by sending a Cache-Control: public, max-age=<long-duration-in-seconds> header so that the assets can be stored in ISP proxy caches as well as browsers on-disk caches

mcpherrinm 15y ago
The problem is that ISP caches are essentially impossible with SPDY, because of mandatory TLS.
- JoshTriplett 15y ago
  I'd consider that a feature, not a bug. Transparent proxies considered harmful, especially when done without informing their users. A SPDY client that trusts a particular proxy could easily allow that proxy to operate on its behalf, and SPDY would actually make that far more efficient.

wmf 15y ago

It looks like SPDY will/could support proxies: http://www.chromium.org/spdy/spdy-proxy http://www.chromium.org/spdy/spdy-proxy http://dev.chromium.org/spdy/spdy-proxy-examples http://dev.chromium.org/spdy/spdy-proxy-examples