10 ms·

Announcing SPDY draft 2 implementation in nginx

145 points by lysol 14y ago

seldo 14y ago
This is a big deal, I think. Ten years from now we're going to look back and discover that Google quietly replaced HTTP without anybody complaining, or even noticing.
- moonboots 14y ago
  I agree it's a big deal, but I wouldn't say people aren't noticing[1][2][3] or complaining[4]. [1] http://tools.ietf.org/html/draft-montenegro-httpbis-speed-mobility-01 [2] http://lists.w3.org/Archives/Public/ietf-http-wg/2012AprJun/0498 [3] http://www.mnot.net/blog/2012/03/31/whats_next_for_http [4] http://librelist.com/browser//mongrel2/2011/8/17/opinions-about-spdy/#e67f0aaa71f4af3f0663195b99217f80
  - seldo 14y ago
    I was thinking more in terms of the average-joe consumer, but then I guess the average-joe consumer never knew what HTTP was anyway.
    - Danieru 14y ago
      Sure they do, it is that thing in front of the hard to type portion of urls.
- thepumpkin1979 14y ago
  I think adoption is driven by real needs and we need SPDY as much as we needed HTML5.
- kristofferR 14y ago
  It won't replace HTTP 1.1, since billions of small sites without SSL certificates can't use it. It might replace HTTP 1.1 if SSL certificates becomes free, automaticly generated, installed and renewed. Otherwise most small websites (the majority of web sites on the net) without any real need for the security provided by encrypted communications (SSL) won't bother dealing with a ton of hassle (or costs) of SSL just for a minor speed improvement.
  - JoshTriplett 14y ago
    Free SSL certificates already exist, accepted by all major browsers: https://www.startssl.com/ https://www.startssl.com/ . Does having to visit that site once a year to renew a certificate really pose a hardship?
    - eggnet 14y ago
      That, and having to have a dedicated ip address due to IE on XP's lack of SNI support.
      - JoshTriplett 14y ago
        IE on XP will never support SPDY, so just fall back to HTTP for IE on XP. :)
        eggnet 14y ago
        But how do you do that? You'd have to have a non-https based landing page and then redirect to spdy based on user agent. If you actually care about SSL, the non-SSL landing page is an attack vector.
        JoshTriplett 14y ago
        You could serve up HSTS records via http, which IE on XP doesn't support either. That'll ensure that all of your repeat visitors use https directly. Also, many sites still serve up their unauthenticated homepages via http only, and such sites should have no problem checking for IE on XP and providing a link that'll work. Depending on the nature of your traffic and how it arrives (e.g. via integration with third-party sites via scripts you've written), you might also have the opportunity to provide the appropriate fallback links to users before they ever reach your site for the first time. And all of the above assumes you have enough IE-on-XP users to not just write them off entirely.
NiekvdMaas 14y ago
For everyone who tries to build this: the URL to the patch file is http://nginx.org/patches/spdy/patch.spdy-35.txt http://nginx.org/patches/spdy/patch.spdy-35.txt, and not the one mentioned in the announcement.
- newman314 14y ago
  It fails to build for me. Got a bunch of warnings being treated as errors. gcc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Wunused-function -Wunused-variable -Wunused-value -Werror -g -march=native -Ofast -fomit-frame-pointer -fstack-protector -D_FORTIFY_SOURCE=2 -flto -fwhole-program -fuse-linker-plugin -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \ -o objs/src/http/ngx_http_spdy.o \ src/http/ngx_http_spdy.c src/http/ngx_http_spdy.c: In function ‘ngx_http_init_spdy’: src/http/ngx_http_spdy.c:261:34: error: variable ‘rc’ set but not used [-Werror=unused-but-set-variable] src/http/ngx_http_spdy.c: In function ‘ngx_http_spdy_process_ping’: src/http/ngx_http_spdy.c:1512:35: error: variable ‘c’ set but not used [-Werror=unused-but-set-variable] src/http/ngx_http_spdy.c: In function ‘ngx_http_spdy_send_rst_stream’: src/http/ngx_http_spdy.c:2552:35: error: variable ‘c’ set but not used [-Werror=unused-but-set-variable] cc1: all warnings being treated as errors I would point out that the -Werror is set by the vanilla version of nginx and not a flag that I passed in.
  - evmar 14y ago
    Warnings are compiler version dependent (and even optimization level dependent, surprisingly). It looks like that one was introduced by gcc 4.6, so perhaps the author of the patch was using a different version. Chrome builds with -Werror on by default but, because of the above reason, recommends any person attempting to build it to turn it off (and provides a flag to do as much).
  - VBart 14y ago
    Thanks, fixed. =) Try again: http://nginx.org/patches/spdy/ http://nginx.org/patches/spdy/ patch.spdy-36.txt or later revision.
mtgx 14y ago
The other article on SPDY complained about it having SSL enabled by default. Is that really something to complain about? Isn't it one of the good things about it, because if SPDY gets adopted, it means everything becomes encrypted? And isn't that a very desirable future?
- e1ven 14y ago
  Having things encrypted is good, yes, but requiring people to get a certificate means that the web has fewer chokepoints, which is bad. IMHO, SSL ought to use a fingerprint-comparison check, instead of a central cert. "This server has changed since last time. Is that OK?"
  - blaenk 14y ago
    What about the first time the user connects, how would they be assured that the fingerprint really is the site's and not a man in the middle? Honest question, myself being pretty new to cryptography.
    - e1ven 14y ago
      In theory, you could do an out-of-band comparison. In practice, you'd generally accept that the first one you receive is valid, and then watch for deviations from there. This is the way SSH works, for instance.
  - X-Istence 14y ago
    http://www.imperialviolet.org/2011/06/16/dnssecchrome.html http://www.imperialviolet.org/2011/06/16/dnssecchrome.html Using DNSSEC we can host the fingerprint of the cert in DNS at which point an CA is not required.
  - caf 14y ago
    How is that a question that any end-user could be expected to answer with any kind of authority?
Ralith 14y ago
I hope SCTP[1] starts to take off soon as a transport for protocols like this, so they don't have to keep working around the limitations of TCP. [1] http://en.wikipedia.org/wiki/SCTP http://en.wikipedia.org/wiki/SCTP
- gregr401 14y ago
  Date of the first RFC is from 2000. I wouldn't hold my breath. Besides, SPDY enablement simply relies on browser / middleware updates changes which can iterate quickly compared to networking gear that needs to support the protocol shift. This was a large factor in building SPDY on top of an existing stack.
  - Zash 14y ago
    Look at how old IPv6 is, and how long it took to get people to start deploying.
chmod775 14y ago
Wait. Did I just read that right? They want to emulate a packet (or frame) based protocol on top of a stream protocol (TCP-Stream) which itself uses packets? That adds umm... how many overhead? Lets count: - Data Link Layer (for instance Ethernet-Frames/Packets) - IPv4/IPv6 - Packets - TCP-Packets --> TCP-Stream - SPDY-Frames --> Multiple Streams - (Edit OK. Maybe not HTTP. Just insert here how they want to transmit the headers) That way we not only send more useless data. We also have to dis- and reassemble everything twice. Why not just extend the TCP-Protocol to support multiple streams? There's still unused space in the header and we have the possibility add additional options. http://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure http://en.wikipedia.org/wiki/Transmission_Control_Protocol#T... Am I missing something? I know that applications are not allowed to send raw TCP-Packets on most OSes by default. But most servers run Linux, which could be easily patched to support such additional features. (And webhosts will have some work to support that new protocol anyways) I don't get it. Edit: SCTP may be a suitable replacement for TCP as mentioned in some other comment. http://en.wikipedia.org/wiki/Stream_Control_Transmission_Protocol http://en.wikipedia.org/wiki/Stream_Control_Transmission_Pro...
- X-Istence 14y ago
  SCTP requires OS support... putting SDPY on top of TCP/IP is just like any other protocol and doesn't require adding an entire new protocol that will have to be firewalled, will have to traverse across different devices that may or may not have SCTP available (such as older consumer routers).
subleq 14y ago
It was much easier to get this working than I thought it would be! Does anyone know when this will be part of an official release?

145 points by lysol 14y ago

seldo 14y ago

This is a big deal, I think. Ten years from now we're going to look back and discover that Google quietly replaced HTTP without anybody complaining, or even noticing.

moonboots 14y ago
I agree it's a big deal, but I wouldn't say people aren't noticing[1][2][3] or complaining[4]. [1] http://tools.ietf.org/html/draft-montenegro-httpbis-speed-mobility-01 [2] http://lists.w3.org/Archives/Public/ietf-http-wg/2012AprJun/0498 [3] http://www.mnot.net/blog/2012/03/31/whats_next_for_http [4] http://librelist.com/browser//mongrel2/2011/8/17/opinions-about-spdy/#e67f0aaa71f4af3f0663195b99217f80
- seldo 14y ago
  I was thinking more in terms of the average-joe consumer, but then I guess the average-joe consumer never knew what HTTP was anyway.
  - Danieru 14y ago
    Sure they do, it is that thing in front of the hard to type portion of urls.
thepumpkin1979 14y ago
I think adoption is driven by real needs and we need SPDY as much as we needed HTML5.
kristofferR 14y ago
It won't replace HTTP 1.1, since billions of small sites without SSL certificates can't use it. It might replace HTTP 1.1 if SSL certificates becomes free, automaticly generated, installed and renewed. Otherwise most small websites (the majority of web sites on the net) without any real need for the security provided by encrypted communications (SSL) won't bother dealing with a ton of hassle (or costs) of SSL just for a minor speed improvement.
- JoshTriplett 14y ago
  Free SSL certificates already exist, accepted by all major browsers: https://www.startssl.com/ https://www.startssl.com/ . Does having to visit that site once a year to renew a certificate really pose a hardship?
  - eggnet 14y ago
    That, and having to have a dedicated ip address due to IE on XP's lack of SNI support.
    - JoshTriplett 14y ago
      IE on XP will never support SPDY, so just fall back to HTTP for IE on XP. :)
      - eggnet 14y ago
        But how do you do that? You'd have to have a non-https based landing page and then redirect to spdy based on user agent. If you actually care about SSL, the non-SSL landing page is an attack vector.
        JoshTriplett 14y ago
        You could serve up HSTS records via http, which IE on XP doesn't support either. That'll ensure that all of your repeat visitors use https directly. Also, many sites still serve up their unauthenticated homepages via http only, and such sites should have no problem checking for IE on XP and providing a link that'll work. Depending on the nature of your traffic and how it arrives (e.g. via integration with third-party sites via scripts you've written), you might also have the opportunity to provide the appropriate fallback links to users before they ever reach your site for the first time. And all of the above assumes you have enough IE-on-XP users to not just write them off entirely.

NiekvdMaas 14y ago

For everyone who tries to build this: the URL to the patch file is http://nginx.org/patches/spdy/patch.spdy-35.txt http://nginx.org/patches/spdy/patch.spdy-35.txt, and not the one mentioned in the announcement.

newman314 14y ago
It fails to build for me. Got a bunch of warnings being treated as errors. gcc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Wunused-function -Wunused-variable -Wunused-value -Werror -g -march=native -Ofast -fomit-frame-pointer -fstack-protector -D_FORTIFY_SOURCE=2 -flto -fwhole-program -fuse-linker-plugin -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \ -o objs/src/http/ngx_http_spdy.o \ src/http/ngx_http_spdy.c src/http/ngx_http_spdy.c: In function ‘ngx_http_init_spdy’: src/http/ngx_http_spdy.c:261:34: error: variable ‘rc’ set but not used [-Werror=unused-but-set-variable] src/http/ngx_http_spdy.c: In function ‘ngx_http_spdy_process_ping’: src/http/ngx_http_spdy.c:1512:35: error: variable ‘c’ set but not used [-Werror=unused-but-set-variable] src/http/ngx_http_spdy.c: In function ‘ngx_http_spdy_send_rst_stream’: src/http/ngx_http_spdy.c:2552:35: error: variable ‘c’ set but not used [-Werror=unused-but-set-variable] cc1: all warnings being treated as errors I would point out that the -Werror is set by the vanilla version of nginx and not a flag that I passed in.
- evmar 14y ago
  Warnings are compiler version dependent (and even optimization level dependent, surprisingly). It looks like that one was introduced by gcc 4.6, so perhaps the author of the patch was using a different version. Chrome builds with -Werror on by default but, because of the above reason, recommends any person attempting to build it to turn it off (and provides a flag to do as much).
- VBart 14y ago
  Thanks, fixed. =) Try again: http://nginx.org/patches/spdy/ http://nginx.org/patches/spdy/ patch.spdy-36.txt or later revision.

mtgx 14y ago

The other article on SPDY complained about it having SSL enabled by default. Is that really something to complain about? Isn't it one of the good things about it, because if SPDY gets adopted, it means everything becomes encrypted? And isn't that a very desirable future?

e1ven 14y ago
Having things encrypted is good, yes, but requiring people to get a certificate means that the web has fewer chokepoints, which is bad. IMHO, SSL ought to use a fingerprint-comparison check, instead of a central cert. "This server has changed since last time. Is that OK?"
- blaenk 14y ago
  What about the first time the user connects, how would they be assured that the fingerprint really is the site's and not a man in the middle? Honest question, myself being pretty new to cryptography.
  - e1ven 14y ago
    In theory, you could do an out-of-band comparison. In practice, you'd generally accept that the first one you receive is valid, and then watch for deviations from there. This is the way SSH works, for instance.
- X-Istence 14y ago
  http://www.imperialviolet.org/2011/06/16/dnssecchrome.html http://www.imperialviolet.org/2011/06/16/dnssecchrome.html Using DNSSEC we can host the fingerprint of the cert in DNS at which point an CA is not required.
- caf 14y ago
  How is that a question that any end-user could be expected to answer with any kind of authority?

Ralith 14y ago

I hope SCTP[1] starts to take off soon as a transport for protocols like this, so they don't have to keep working around the limitations of TCP. [1] http://en.wikipedia.org/wiki/SCTP http://en.wikipedia.org/wiki/SCTP

gregr401 14y ago
Date of the first RFC is from 2000. I wouldn't hold my breath. Besides, SPDY enablement simply relies on browser / middleware updates changes which can iterate quickly compared to networking gear that needs to support the protocol shift. This was a large factor in building SPDY on top of an existing stack.
- Zash 14y ago
  Look at how old IPv6 is, and how long it took to get people to start deploying.

chmod775 14y ago

Wait. Did I just read that right? They want to emulate a packet (or frame) based protocol on top of a stream protocol (TCP-Stream) which itself uses packets? That adds umm... how many overhead? Lets count: - Data Link Layer (for instance Ethernet-Frames/Packets) - IPv4/IPv6 - Packets - TCP-Packets --> TCP-Stream - SPDY-Frames --> Multiple Streams - (Edit OK. Maybe not HTTP. Just insert here how they want to transmit the headers) That way we not only send more useless data. We also have to dis- and reassemble everything twice. Why not just extend the TCP-Protocol to support multiple streams? There's still unused space in the header and we have the possibility add additional options. http://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure http://en.wikipedia.org/wiki/Transmission_Control_Protocol#T... Am I missing something? I know that applications are not allowed to send raw TCP-Packets on most OSes by default. But most servers run Linux, which could be easily patched to support such additional features. (And webhosts will have some work to support that new protocol anyways) I don't get it. Edit: SCTP may be a suitable replacement for TCP as mentioned in some other comment. http://en.wikipedia.org/wiki/Stream_Control_Transmission_Protocol http://en.wikipedia.org/wiki/Stream_Control_Transmission_Pro...

X-Istence 14y ago
SCTP requires OS support... putting SDPY on top of TCP/IP is just like any other protocol and doesn't require adding an entire new protocol that will have to be firewalled, will have to traverse across different devices that may or may not have SCTP available (such as older consumer routers).

subleq 14y ago

It was much easier to get this working than I thought it would be! Does anyone know when this will be part of an official release?