7 ms·

Wow this is a big release! HTTP 2.0, phasing out 1024 certs, sync, will-change. BTW, is there already support for 4096 certs? Or is that coming later?

by mcdoug 12y ago

blinkingled 12y ago
Yeah, the full HTTP/2 support was a pleasant surprise! Wonder if Google's (and other prominent ones) web properties have switched over to HTTP/2 from SPDY yet.
- sp332 12y ago
  According to http://spdycheck.org/#google.com http://spdycheck.org/#google.com google.com supports "h2-14" and "h2-15" which I'm guessing are drafts of HTTP/2?
  - gsnedders 12y ago
    Right. "h2" is what the final spec should give.
    - patrickmcmanus 12y ago
      firefox 36 will negotiate any of {h2, h2-14, h2-15}
- ropiku 12y ago
  Using FirefoxDevEdition with SPDY indicator shows me Google, Youtube and Twitter over HTTP/2.
  - deleted 12y ago
    [deleted]
- mbrubeck 12y ago
  Yes. According to Patrick McManus (owner of Gecko's networking stack), 9% of Firefox requests are already using HTTP/2 with the draft implementation enabled for Google (and now Twitter). With Google alone, HTTP/2 usage is already higher than SPDY. http://bitsup.blogspot.com/2015/02/http2-is-live-in-firefox.html http://bitsup.blogspot.com/2015/02/http2-is-live-in-firefox....
higherpurpose 12y ago
Why 4096-bit RSA certs when you can have ECC certs?
- sarciszewski 12y ago
  I for one welcome our EdDSA-ECDHE-AES-GCM overlords. (I know we're not there yet :P)
- pslam 12y ago
  There are installations which don't support ECC, usually due to hardware limitations, but do support RSA-4k. Often this cert is the trust anchor for various other uses than just SSL, so the result is you end up using RSA-4k instead of ECC. There's also folks who don't entirely trust ECC because it's "too new". To be fair, RSA isn't broken, and 4k is sufficiently big to be safe even with a partial break.
  - jimktrains2 12y ago
    > There are installations which don't support ECC, usually due to hardware limitations Isn't RSA much more computationally expensive than ECC? What hardware can do RSA but not ECC? /me sits down to be schooled
    - jimktrains2 12y ago
      Since I can't edit: EDIT: Unless you're referring to embedded systems that can't be updated?
      - pslam 12y ago
        Bingo :) Actually, not just embedded systems. There's HSMs (hardware security modules) which also can't be updated to support new functions. Often this is because the underlying primitives have been implemented in fixed-function hardware to prevent timing, power and even RF analysis.
sandstrom 12y ago
Anyone know of a brief list of workarounds/schemes/optimizations that probably won't be needed (or will be less needed) with http2? (or just add to this list) - css sprites - monolith js/css-files - rotating through 'alias'-subdomains for resources - trimming cookies / cookie-less domains (for request-headers)
- Millennium 12y ago
  Sprites and concatenated js/css are still useful. HTTP/2 lets you make 100 requests over a single connection, and that's a lot better than making 100 requests over 100 connections, but it's still not going to beat one request over one connection.
  - acdha 12y ago
    That would be an interesting thing to benchmark, particularly since separate resources can be cached independently. If you're using every single image, line of JavaScript, etc. as soon as the page loads, a single large file will probably still be faster. If, however, you have a mix of things which are only used for optional features, not on every page, etc. there's room for some nice improvements because independent resources can be loaded immediately whereas a huge concatenated JavaScript file has to wait for the entire transfer before it can be safely executed. If your site really needs jQuery and 90 plugins to work at all, that doesn't help, but if a fair amount of your code can be loaded independently the overall load time can be shorter if some of the code executes while other resources are still fetching rather than waiting until it has everything. The independent fetch + caching is also more valuable for repeat visitors who have cached copies of everything which didn't change – i.e. if you only touched an icon in the footer of your page, the experience is better if your header logo displays instantly out of the cache rather than having to wait for an entire sprite to reload.
  - plorkyeran 12y ago
    One image with 100 icons also still compresses better than 100 files with 1 icon each.
  - riquito 12y ago

Wow this is a big release! HTTP 2.0, phasing out 1024 certs, sync, will-change. BTW, is there already support for 4096 certs? Or is that coming later?

by mcdoug 12y ago

Wow this is a big release! HTTP 2.0, phasing out 1024 certs, sync, will-change. BTW, is there already support for 4096 certs? Or is that coming later?

blinkingled 12y ago

Yeah, the full HTTP/2 support was a pleasant surprise! Wonder if Google's (and other prominent ones) web properties have switched over to HTTP/2 from SPDY yet.

sp332 12y ago
According to http://spdycheck.org/#google.com http://spdycheck.org/#google.com google.com supports "h2-14" and "h2-15" which I'm guessing are drafts of HTTP/2?
- gsnedders 12y ago
  Right. "h2" is what the final spec should give.
  - patrickmcmanus 12y ago
    firefox 36 will negotiate any of {h2, h2-14, h2-15}
ropiku 12y ago
Using FirefoxDevEdition with SPDY indicator shows me Google, Youtube and Twitter over HTTP/2.
- deleted 12y ago
  [deleted]
mbrubeck 12y ago
Yes. According to Patrick McManus (owner of Gecko's networking stack), 9% of Firefox requests are already using HTTP/2 with the draft implementation enabled for Google (and now Twitter). With Google alone, HTTP/2 usage is already higher than SPDY. http://bitsup.blogspot.com/2015/02/http2-is-live-in-firefox.html http://bitsup.blogspot.com/2015/02/http2-is-live-in-firefox....

higherpurpose 12y ago

Why 4096-bit RSA certs when you can have ECC certs?

sarciszewski 12y ago
I for one welcome our EdDSA-ECDHE-AES-GCM overlords. (I know we're not there yet :P)
pslam 12y ago
There are installations which don't support ECC, usually due to hardware limitations, but do support RSA-4k. Often this cert is the trust anchor for various other uses than just SSL, so the result is you end up using RSA-4k instead of ECC. There's also folks who don't entirely trust ECC because it's "too new". To be fair, RSA isn't broken, and 4k is sufficiently big to be safe even with a partial break.
- jimktrains2 12y ago
  > There are installations which don't support ECC, usually due to hardware limitations Isn't RSA much more computationally expensive than ECC? What hardware can do RSA but not ECC? /me sits down to be schooled
  - jimktrains2 12y ago
    Since I can't edit: EDIT: Unless you're referring to embedded systems that can't be updated?
    - pslam 12y ago
      Bingo :) Actually, not just embedded systems. There's HSMs (hardware security modules) which also can't be updated to support new functions. Often this is because the underlying primitives have been implemented in fixed-function hardware to prevent timing, power and even RF analysis.

sandstrom 12y ago

Anyone know of a brief list of workarounds/schemes/optimizations that probably won't be needed (or will be less needed) with http2? (or just add to this list) - css sprites - monolith js/css-files - rotating through 'alias'-subdomains for resources - trimming cookies / cookie-less domains (for request-headers)

Millennium 12y ago
Sprites and concatenated js/css are still useful. HTTP/2 lets you make 100 requests over a single connection, and that's a lot better than making 100 requests over 100 connections, but it's still not going to beat one request over one connection.
- acdha 12y ago
  That would be an interesting thing to benchmark, particularly since separate resources can be cached independently. If you're using every single image, line of JavaScript, etc. as soon as the page loads, a single large file will probably still be faster. If, however, you have a mix of things which are only used for optional features, not on every page, etc. there's room for some nice improvements because independent resources can be loaded immediately whereas a huge concatenated JavaScript file has to wait for the entire transfer before it can be safely executed. If your site really needs jQuery and 90 plugins to work at all, that doesn't help, but if a fair amount of your code can be loaded independently the overall load time can be shorter if some of the code executes while other resources are still fetching rather than waiting until it has everything. The independent fetch + caching is also more valuable for repeat visitors who have cached copies of everything which didn't change – i.e. if you only touched an icon in the footer of your page, the experience is better if your header logo displays instantly out of the cache rather than having to wait for an entire sprite to reload.
- plorkyeran 12y ago
  One image with 100 icons also still compresses better than 100 files with 1 icon each.
- riquito 12y ago