4 ms·
What will this mean for caching proxies? These can be really useful in datacentre environments. For data that is nominally public anyway, I prefer to be able t
by rlpb 13y ago
What will this mean for caching proxies? These can be really useful in datacentre environments.
For data that is nominally public anyway, I prefer to be able to stick a caching proxy somewhere, and rely on other means (eg. apt's gpg and hash verification) to ensure integrity.
The article says: "Alternate approaches to proxy caching (such as peer-to-peer caching protocols) may be proposed here or elsewhere, since traditional proxy caching use cases will no longer be met when TLS is in wider use."
- perbu 13y agoYou might be confusing forward- and reverse proxies. Transparent forward proxies can now go bugger off. They will not be able to intercept HTTP/2.0 traffic. Reverse proxies, in front of web applications will need to terminate the SSL before caching. Same as today.
- rlpb 13y agoProxies don't have to be transparent. Non-transparent forward proxies that I set up and choose to use are very handy because I get a direct performance improvement out of them. As an aside, I hear that in much of the more distant parts of the world (Australia/New Zealand) transparent forward proxies are common amongst consumer ISPs to help with their high latency to the rest of the world.
- leoc 13y agoWhat's wrong in principle with transparent forward proxying anyway? From almost any perspective other than security/anonymity, forcing a client to make a TCP connection to a publisher's computers every time the client wants to read one of the publisher's documents* is a terrible decision: stark, screaming madness. If transparent forward proxying breaks things with HTTP then that's a problem with HTTP. Even from a security/anonymity point of view, an end-to-end connection is no panacea either: if encrypted it (hopefully) prevents third parties from seeing the content of the data sent, but it also makes damned sure that the publisher gets the client's IP address every time the client GETs a webpage, and as recent events have illustrated publisher endpoints aren't super-trustworthy either. * Unless the client itself has an older copy which it knows hasn't expired; but a single client is much more unlikely to happen to have one of those than is a proxy which handles requests from many clients, and probably has more storage space to devote to caching too.
- VLM 13y agoFor APT couldn't you just force HTTP v1 to permit caching? Most clusters of linux boxes I've admined I end up with a dedicated APT proxy on one machine, not a generic http network level proxy. The proxy I use has varied over time but at this moment I'm mostly using the approx package.
- rlpb 13y agoI could; I don't like the idea of multiple versions of a standard being necessary, though. Why can't the newest version support all reasonable use cases?
- bhouston 13y agoLarge companies who install transparent proxies can often find 10%-20% byte hit rate. It is said to see this go away with the move to HTTPS everywhere. I wonder if transparent proxy caches are a thing of the past now?
- frenchy 13y agoI kind of hope so. While they were very convenient, they had some limitations, and had some very confusing failure modes (for example, trying to go to an HTTPS site before accepting the boilerplate TOS agreements). I think developing some sort of proxy discovery protocol and making it clear to users that their connection is proxied is a much better way forward.
- yxhuvud 13y agoProxies are not the only thing that is necessary to support - login portals is another related usage in the same general area. Basically the problem is that the encryption possibilities available assume Internet is a dumb pipe between source and destination, but that is simply not the case.
- donavanm 13y agoIf you own the client and the proxy its still possible. Install a controlled root cert on the clients. On the proxy dynamically create & sign certs for each domain the client requests. Present these false certs to the clients connection. On the "north" end the proxy is now responsible for verifying the remote cert chains etc. Proxy has access to all the bytes, programmatic clients succeed in auth, human clients have a green check box in the browser. Totally doable today. I think some of the commercial appliances even do this for you.
- wmf 13y agohttps: should use CONNECT regardless of version. For http: the proxy will probably decrypt and then re-encrypt which will allow caching and inspection.