4 ms·

It's unfortunate that this is necessary. I like the concept of decentralized cache systems, but in the future CDN will be the only option for low latency.

by brlewis 12y ago

Animats 12y ago
That's what bothers me. HTTPS Everywhere means MITM Everywhere. Terminating HTTPS connections at a CDN means the CDN is the man in the middle. You don't have to attack secure servers that handle important stuff any more; just get a backdoor into Cloudflare. This makes "authorized law enforcement access" easier than ever. On top of that, HTTP2's "it all has to go through one hole" approach means that CDNs become almost mandatory for big sites. The Web is becoming a lot more centralized. It's more secure against random attackers, but much less secure from inside jobs at CDNs, authorized or not. The Great Firewall of China people must love this.
- M2Ys4U 12y ago
  >That's what bothers me. HTTPS Everywhere means MITM Everywhere. Terminating HTTPS connections at a CDN means the CDN is the man in the middle. CDNs are already Men In The Middle.
- exelius 12y ago
  CDNs are already mandatory for big sites and have been for a decade or more. There's just no other way to scale and keep a handle on costs. If you don't use a CDN, you'll get murdered by transit costs (Netflix learned this the hard way before they built OpenConnect -- an in-house CDN).
- jerf 12y ago
  HTTPS has never guaranteed that you were speaking directly to a given entity. In the case of a corporation, what does that really mean, anyhow? Your web request is being handled by the CEO him- or herself? It only means you are speaking to a device or set of devices that the certificate-holding entity has authorized to speak for them. No certificate technology can prevent a company from delegating authority to another entity's devices. It isn't that this isn't necessarily a problem... it is that there is no way in which certificates ever solved it, nor a way in which it can solve it, and there's no choice. Whenever you're talking to X.com, you are almost certainly also talking to a third-party web stack, for instance, which means that trust has been delegated by the certificate holder to some other party's software. There's hardly a website around that doesn't have a whackload (technical term) of third parties already in the connection anyhow. The certificate-holding entity is ultimately responsible for what they do with your trust. But the certificate can do nothing to constrain those actions. It's just a glorified number with some other glorified numbers attached to it. It does seem to me though that HTTP2 should actually make it easier to do without a CDN in the end, though. Initial HTTP2 support will just be "HTTP1, but on HTTP2!" which really provides minimal advantages over HTTP1, but over time as we see web frameworks start to take direct advantage of being able to push down resources preemptively, the advantages of CDNs for all but the largest sites start to fade. (Perhaps not "eliminated", but certainly lessened.) (Incidentally, as people will presumably start releasing HTTP2 benchmarks soon, keep on eye on the details. Embedding HTTP1 inside HTTP2 is not the interesting performance question and will never have big gains... the correct question to investigate is what are the gains to be had from fully using HTTP2 natively. Many SPDY benchmarks had the same problem... of course SPDY isn't faster if it's still essentially speaking HTTP1 to the target website.)
- profmonocle 12y ago
  > On top of that, HTTP2's "it all has to go through one hole" approach means that CDNs become almost mandatory for big sites. No, it just makes multiple requests to the same domain more efficient. Requests to external domains still work.
tootie 12y ago
I'm confused. I don't see how HTTPS makes this problem worse or better.
- brlewis 12y ago
  With HTTP, your ISP can be a benign "man in the middle" and cache resources for customers. See http://en.wikipedia.org/wiki/Proxy_server#Transparent_proxy http://en.wikipedia.org/wiki/Proxy_server#Transparent_proxy
voidlogic 12y ago
The real victim here is institutions can no longer operate transparent caches. For example, I have seen a 800 bed hospital in a rural area get very far with a relatively weak (but best it could get) Internet connection by having transparent caching. Colleges with dorms, even in non-rural areas safe huge amounts of bandwith this way too.

It's unfortunate that this is necessary. I like the concept of decentralized cache systems, but in the future CDN will be the only option for low latency.

by brlewis 12y ago

It's unfortunate that this is necessary. I like the concept of decentralized cache systems, but in the future CDN will be the only option for low latency.

Animats 12y ago

That's what bothers me. HTTPS Everywhere means MITM Everywhere. Terminating HTTPS connections at a CDN means the CDN is the man in the middle. You don't have to attack secure servers that handle important stuff any more; just get a backdoor into Cloudflare. This makes "authorized law enforcement access" easier than ever. On top of that, HTTP2's "it all has to go through one hole" approach means that CDNs become almost mandatory for big sites. The Web is becoming a lot more centralized. It's more secure against random attackers, but much less secure from inside jobs at CDNs, authorized or not. The Great Firewall of China people must love this.

M2Ys4U 12y ago
>That's what bothers me. HTTPS Everywhere means MITM Everywhere. Terminating HTTPS connections at a CDN means the CDN is the man in the middle. CDNs are already Men In The Middle.
exelius 12y ago
CDNs are already mandatory for big sites and have been for a decade or more. There's just no other way to scale and keep a handle on costs. If you don't use a CDN, you'll get murdered by transit costs (Netflix learned this the hard way before they built OpenConnect -- an in-house CDN).
jerf 12y ago
HTTPS has never guaranteed that you were speaking directly to a given entity. In the case of a corporation, what does that really mean, anyhow? Your web request is being handled by the CEO him- or herself? It only means you are speaking to a device or set of devices that the certificate-holding entity has authorized to speak for them. No certificate technology can prevent a company from delegating authority to another entity's devices. It isn't that this isn't necessarily a problem... it is that there is no way in which certificates ever solved it, nor a way in which it can solve it, and there's no choice. Whenever you're talking to X.com, you are almost certainly also talking to a third-party web stack, for instance, which means that trust has been delegated by the certificate holder to some other party's software. There's hardly a website around that doesn't have a whackload (technical term) of third parties already in the connection anyhow. The certificate-holding entity is ultimately responsible for what they do with your trust. But the certificate can do nothing to constrain those actions. It's just a glorified number with some other glorified numbers attached to it. It does seem to me though that HTTP2 should actually make it easier to do without a CDN in the end, though. Initial HTTP2 support will just be "HTTP1, but on HTTP2!" which really provides minimal advantages over HTTP1, but over time as we see web frameworks start to take direct advantage of being able to push down resources preemptively, the advantages of CDNs for all but the largest sites start to fade. (Perhaps not "eliminated", but certainly lessened.) (Incidentally, as people will presumably start releasing HTTP2 benchmarks soon, keep on eye on the details. Embedding HTTP1 inside HTTP2 is not the interesting performance question and will never have big gains... the correct question to investigate is what are the gains to be had from fully using HTTP2 natively. Many SPDY benchmarks had the same problem... of course SPDY isn't faster if it's still essentially speaking HTTP1 to the target website.)
profmonocle 12y ago
> On top of that, HTTP2's "it all has to go through one hole" approach means that CDNs become almost mandatory for big sites. No, it just makes multiple requests to the same domain more efficient. Requests to external domains still work.

tootie 12y ago

I'm confused. I don't see how HTTPS makes this problem worse or better.

brlewis 12y ago
With HTTP, your ISP can be a benign "man in the middle" and cache resources for customers. See http://en.wikipedia.org/wiki/Proxy_server#Transparent_proxy http://en.wikipedia.org/wiki/Proxy_server#Transparent_proxy

voidlogic 12y ago

The real victim here is institutions can no longer operate transparent caches. For example, I have seen a 800 bed hospital in a rural area get very far with a relatively weak (but best it could get) Internet connection by having transparent caching. Colleges with dorms, even in non-rural areas safe huge amounts of bandwith this way too.