4 ms·

Is it safe to use SPDY implementation at that point? I've seen critical flaws in the past...

• billyhoffman 12y ago
  The largest security issue with SPDY was CRIME, which was specifically caused by a gzip-compress-then-encrypt problem with the HTTP headers (which can contain attacker controlled info). The switch to HPACK for header compression resolved this. SPDY/HTTP2 has no currently known security flaws.
  • konklone 12y ago
    Exactly - and that's why we have SPDY header compression disabled on our nginx config: https://github.com/18F/tls-standards/blob/master/configuration/nginx/ssl.rules#L42-L46 https://github.com/18F/tls-standards/blob/master/configurati... When SPDY 4 or HTTP/2 make their way into an nginx module, we'll upgrade, and turn header compression back on.
    • konklone 12y ago
      Er, so I take this back? Ilya Grigorik rang in and told me I wasn't distinguishing between request and response headers: https://github.com/18F/tls-standards/issues/24 https://github.com/18F/tls-standards/issues/24