4 ms·

PHK discusses a lot of these point here: http://www.infoq.com/presentations/HTTP-Performance http://www.infoq.com/presentations/HTTP-Performance (especially his

by Argorak 12y ago

PHK discusses a lot of these point here: http://www.infoq.com/presentations/HTTP-Performance http://www.infoq.com/presentations/HTTP-Performance (especially his views on encryption) (sorry for the repost, this wasn't posted when I posted the other one)

jerf 12y ago
This is probably a better link: https://www.varnish-cache.org/docs/trunk/phk/http20.html https://www.varnish-cache.org/docs/trunk/phk/http20.html There's a lot of fairly concrete issues in there, concrete suggestions for improvements, concrete suggestions for better problems to focus on (it's hard to overestimate how important that is for proper engineering!), and it's in text instead of a 40 minute video.
- Argorak 12y ago
  I disagree, the link is also interesting, but as I said further down: the video holds an interesting discussion of his views on encryption, especially end-to-end, something the parent explicitly discussed.
- MichaelGG 12y ago
  So as a problem, he lists server push. What other proposals are there to get rid of stuff like spritesheets?
Luker88 12y ago
Just saw it. Basically he's an advocate of the "only bad guys want privacy everywhere". I still have not seen a single proposal from him that is not "forget about crypto", or "let everything be tracked". He doesn't seems to even understand how basic key exchange work, and all his arguments boil down to "I think they can break it anyway, so we should stop using it". IMHO, forget about him. he has no proposal and his understanding of security and crypto is downright dangerous.
- phkamp 12y ago
  You obviously havn't spent much time looking either, have you? You could look at section 15 here for instance: http://phk.freebsd.dk/words/httpbis.html http://phk.freebsd.dk/words/httpbis.html With respect to key-exchange, maybe the problem is that I do understand, and therefore know that there is a difference between privacy and secrecy ? Some places we want privacy, some places we want secrecy. Mandating privacy everywhere makes it almost mandatory for police-states to trojan the privacy infrastructure (ie: CA's -- yes they already did), and therefore we have neither privacy nor secrecy anymore. PS: Dangerous for who ? PPS": Google "Operation Orchestra" if you don't undstand the previous question.
  - arielby 12y ago
    Police-States would try to trojan the CA infrastructure anyway – its too much tempting a target. Inspecting proxies work well enough with HTTP 1.1, there's no real need to improve them, and even if we do, it should be done via a proxy mechanism, rather than via sending more things in plaintext than we have. Anyway, HTTPS routers can (and should) terminate SSL, and in that case they can even read the Host from SNI.
  - aestetix 12y ago
    Privacy isn't a binary. Neither is secrecy. It's a function of relationships. So the question isn't whether children have privacy, but against whom are they able to be private, in what regard? While I'm generally ok with parents knowing where their kids are, I'm not as ok with a random creep in the neighborhood knowing. As far as criminals and prisoners, it's far more granular than that. If I get caught shoplifting, does that suddenly mean all my medical records are up for grabs? If I am a prisoner, am I allowed to refuse to see someone who comes to visit me?

by Argorak 12y ago

jerf 12y ago

This is probably a better link: https://www.varnish-cache.org/docs/trunk/phk/http20.html https://www.varnish-cache.org/docs/trunk/phk/http20.html There's a lot of fairly concrete issues in there, concrete suggestions for improvements, concrete suggestions for better problems to focus on (it's hard to overestimate how important that is for proper engineering!), and it's in text instead of a 40 minute video.

Argorak 12y ago
I disagree, the link is also interesting, but as I said further down: the video holds an interesting discussion of his views on encryption, especially end-to-end, something the parent explicitly discussed.
MichaelGG 12y ago
So as a problem, he lists server push. What other proposals are there to get rid of stuff like spritesheets?

Luker88 12y ago

Just saw it. Basically he's an advocate of the "only bad guys want privacy everywhere". I still have not seen a single proposal from him that is not "forget about crypto", or "let everything be tracked". He doesn't seems to even understand how basic key exchange work, and all his arguments boil down to "I think they can break it anyway, so we should stop using it". IMHO, forget about him. he has no proposal and his understanding of security and crypto is downright dangerous.

phkamp 12y ago
You obviously havn't spent much time looking either, have you? You could look at section 15 here for instance: http://phk.freebsd.dk/words/httpbis.html http://phk.freebsd.dk/words/httpbis.html With respect to key-exchange, maybe the problem is that I do understand, and therefore know that there is a difference between privacy and secrecy ? Some places we want privacy, some places we want secrecy. Mandating privacy everywhere makes it almost mandatory for police-states to trojan the privacy infrastructure (ie: CA's -- yes they already did), and therefore we have neither privacy nor secrecy anymore. PS: Dangerous for who ? PPS": Google "Operation Orchestra" if you don't undstand the previous question.
- arielby 12y ago
  Police-States would try to trojan the CA infrastructure anyway – its too much tempting a target. Inspecting proxies work well enough with HTTP 1.1, there's no real need to improve them, and even if we do, it should be done via a proxy mechanism, rather than via sending more things in plaintext than we have. Anyway, HTTPS routers can (and should) terminate SSL, and in that case they can even read the Host from SNI.
- aestetix 12y ago
  Privacy isn't a binary. Neither is secrecy. It's a function of relationships. So the question isn't whether children have privacy, but against whom are they able to be private, in what regard? While I'm generally ok with parents knowing where their kids are, I'm not as ok with a random creep in the neighborhood knowing. As far as criminals and prisoners, it's far more granular than that. If I get caught shoplifting, does that suddenly mean all my medical records are up for grabs? If I am a prisoner, am I allowed to refuse to see someone who comes to visit me?