6 ms·

Great initiative, minor drawbacks such as up to 20% of the traffic wouldn't apply due to their use of SNI: "Globally, more than 80% of requests come from moder

Great initiative, minor drawbacks such as up to 20% of the traffic wouldn't apply due to their use of SNI: "Globally, more than 80% of requests come from modern browsers, and that percentage is growing quickly." EDIT: Mixed content on that page (within the embedded map at https://cloudflare.github.io/sni-visualization/ https://cloudflare.github.io/sni-visualization/)

makomk 12y ago
SNI isn't the only problem either. Apparently they're using ECDSA-based certificates which aren't generally used and aren't supported by older browsers.
- dspillett 12y ago
  People who are behind the times browser-wise tend to be very behind (IE on XP, Android 2.x/3.x) - so I don't think ECDSA will be much of a limiting factor once you take people who can't access SNI based certs out of consideration.
  - eastdakota 12y ago
    That's correct. There's an almost perfect overlap of browsers that support ECDSA and SNI.
nknighthb 12y ago
If your target audience is in the west, it's more like 5-10%, and the problem there is going away. XP and Android 2.x are dropping off pretty quickly.
- nirvdrum 12y ago
  The larger problem I had was with non-interactive browsers. E.g., GitHub changed their downloads server to use SNI and overnight a bunch of scripts I had using wget on Ubuntu 12.04 (a distribution supported until 2017) stopped working. Java 6 doesn't support SNI, so you need to watch your API stats. And I seem to recall using versions of Python and Ruby that also didn't support it.
  - nknighthb 12y ago
    I wonder if Canonical could be talked into getting an SNI-enabled wget into 12.04. Though if it were me, my response would probably just be "use curl" (which does work in 12.04. I don't know what the status is in Ruby. Python 3 supports SNI natively. Python 2.x does not with the included libraries, but can be made to. (You're shooting yourself in the foot by using Python 2.x's included libraries with HTTPS anyway -- it doesn't verify certificates. Oops.)
    - nirvdrum 12y ago
      Yeah, curl is an option. It just kinda sucks when things that have worked for years break overnight because of an otherwise transparent upstream SSL change. My guess is since introducing an SNI-compatible version is outside the scope of a security release, it won't end up happening.
      - nknighthb 12y ago
        I think there's a strong argument to be made that not supporting SNI is a security problem, and will become quite a serious one over the next few years. SNI is fait accompli. It will be adopted. It is being adopted. Without support for it, a rapidly growing number of sites will not be securely accessible, and effective regressions like the one you experienced will be encountered more and more frequently. And in an age where interconnected systems are the default assumption and those systems change fast, I don't think it's realistic to adhere to an overly strict policy about what updates can be brought in during extended support cycles. I think Red Hat recognized this a while back. Canonical probably needs to.
terinjokes 12y ago
Thanks for catching, I've fixed.

makomk 12y ago

SNI isn't the only problem either. Apparently they're using ECDSA-based certificates which aren't generally used and aren't supported by older browsers.

dspillett 12y ago
People who are behind the times browser-wise tend to be very behind (IE on XP, Android 2.x/3.x) - so I don't think ECDSA will be much of a limiting factor once you take people who can't access SNI based certs out of consideration.
- eastdakota 12y ago
  That's correct. There's an almost perfect overlap of browsers that support ECDSA and SNI.

nknighthb 12y ago

If your target audience is in the west, it's more like 5-10%, and the problem there is going away. XP and Android 2.x are dropping off pretty quickly.

nirvdrum 12y ago
The larger problem I had was with non-interactive browsers. E.g., GitHub changed their downloads server to use SNI and overnight a bunch of scripts I had using wget on Ubuntu 12.04 (a distribution supported until 2017) stopped working. Java 6 doesn't support SNI, so you need to watch your API stats. And I seem to recall using versions of Python and Ruby that also didn't support it.
- nknighthb 12y ago
  I wonder if Canonical could be talked into getting an SNI-enabled wget into 12.04. Though if it were me, my response would probably just be "use curl" (which does work in 12.04. I don't know what the status is in Ruby. Python 3 supports SNI natively. Python 2.x does not with the included libraries, but can be made to. (You're shooting yourself in the foot by using Python 2.x's included libraries with HTTPS anyway -- it doesn't verify certificates. Oops.)
  - nirvdrum 12y ago
    Yeah, curl is an option. It just kinda sucks when things that have worked for years break overnight because of an otherwise transparent upstream SSL change. My guess is since introducing an SNI-compatible version is outside the scope of a security release, it won't end up happening.
    - nknighthb 12y ago
      I think there's a strong argument to be made that not supporting SNI is a security problem, and will become quite a serious one over the next few years. SNI is fait accompli. It will be adopted. It is being adopted. Without support for it, a rapidly growing number of sites will not be securely accessible, and effective regressions like the one you experienced will be encountered more and more frequently. And in an age where interconnected systems are the default assumption and those systems change fast, I don't think it's realistic to adhere to an overly strict policy about what updates can be brought in during extended support cycles. I think Red Hat recognized this a while back. Canonical probably needs to.

terinjokes 12y ago

Thanks for catching, I've fixed.