4 ms·

Why I don't like SPDY

12 points by slyall 15y ago

chc 15y ago
For the few who can't just use StartSSL, couldn't you just use a self-signed certificate? I mean, it's suboptimal, but it's a far cry from "no way," isn't it?
- kbuck 15y ago
  Widespread usage of self-signed certificates might have the unfortunate effect of training people to click "allow invalid certificate" when they shouldn't (such as what happened with Vista's UAC). I would also argue that unless your users are technically inclined, a self-signed certificate is as good as (or worse, due to the scary browser warnings) as an unencrypted connection.
- papaf 15y ago
  It would be workable if browsers stopped loudly complaining about self-signed certificates and gracefully fell back to using something like TOFU/POP [1] or Convergence [2]. [1] http://www.xmlgrrl.com/blog/2010/07/06/tofu-online-trust-and-spiritual-wisdom/ http://www.xmlgrrl.com/blog/2010/07/06/tofu-online-trust-and... [2] http://convergence.io/ http://convergence.io/
  - chc 15y ago
    Ah, true. I wonder if it wouldn't be best if, by default, browsers would only complain when a site switched to an untrusted cert it hadn't used before (i.e. if Facebook.com is suddenly self-signed, that's a problem, and if a site switches from one self-signed cert to another, that's a problem as well). This would prevent most MITMs while still making self-signed certs useable. A site with a self-signed cert is better than one using no security at all, so it shouldn't get more flack.
ssoroka 15y ago
Nothing is stopping browsers from supporting http 1.1 and SPDY at the same time. SPDY doesnt "force" anyone to support it. You just sound like the anti-change crowd to me. Irrelevant.
- acidblue 15y ago
  Exactly. Plus, it probably makes Varnish worthless in this environment (I'm sensing bias here). I suppose the author doesn't like purchasing goods and services over a secure connection either. Next.
- willvarfar 15y ago
  no no no - what we want is SPDY without encryption/signing. http://williamedwardscoder.tumblr.com/post/20125275380/why-per-buer-varnish-cache-doesnt-like-spdy http://williamedwardscoder.tumblr.com/post/20125275380/why-p...

12 points by slyall 15y ago

chc 15y ago

For the few who can't just use StartSSL, couldn't you just use a self-signed certificate? I mean, it's suboptimal, but it's a far cry from "no way," isn't it?

kbuck 15y ago
Widespread usage of self-signed certificates might have the unfortunate effect of training people to click "allow invalid certificate" when they shouldn't (such as what happened with Vista's UAC). I would also argue that unless your users are technically inclined, a self-signed certificate is as good as (or worse, due to the scary browser warnings) as an unencrypted connection.
papaf 15y ago
It would be workable if browsers stopped loudly complaining about self-signed certificates and gracefully fell back to using something like TOFU/POP [1] or Convergence [2]. [1] http://www.xmlgrrl.com/blog/2010/07/06/tofu-online-trust-and-spiritual-wisdom/ http://www.xmlgrrl.com/blog/2010/07/06/tofu-online-trust-and... [2] http://convergence.io/ http://convergence.io/
- chc 15y ago
  Ah, true. I wonder if it wouldn't be best if, by default, browsers would only complain when a site switched to an untrusted cert it hadn't used before (i.e. if Facebook.com is suddenly self-signed, that's a problem, and if a site switches from one self-signed cert to another, that's a problem as well). This would prevent most MITMs while still making self-signed certs useable. A site with a self-signed cert is better than one using no security at all, so it shouldn't get more flack.

ssoroka 15y ago

Nothing is stopping browsers from supporting http 1.1 and SPDY at the same time. SPDY doesnt "force" anyone to support it. You just sound like the anti-change crowd to me. Irrelevant.

acidblue 15y ago
Exactly. Plus, it probably makes Varnish worthless in this environment (I'm sensing bias here). I suppose the author doesn't like purchasing goods and services over a secure connection either. Next.
willvarfar 15y ago
no no no - what we want is SPDY without encryption/signing. http://williamedwardscoder.tumblr.com/post/20125275380/why-per-buer-varnish-cache-doesnt-like-spdy http://williamedwardscoder.tumblr.com/post/20125275380/why-p...