Viewing profile — BobVerg

15,000 pageviews per day == just 10-20 views per minute. Very low load actually.

CRIME attack isn't specific to request or response. If you pass secrets in response headers, then the attack can be performed against them.

It's because of CRIME vulnerability.

"spdy_headers_comp 7;" looks like huge overkill. It provides about 10% better compression ratio than setting 1, but two times slower.

There are official Linux packages with the latest version: http://nginx.org/en/linux_packages.html#mainline

Ok. To exploit any vulnerability the attacker have to do something. It's just obvious. I don't understand what you're trying to make clear. > and attacker handcraft an http request…

A few quotes from the link, if you didn't read: "Some checks on a request URI were not executed on a character following an unescaped space character (which is invalid per HTTP pro…

No, it won't be %20. It isn't encoded. You should mkdir or touch "name ", not "name%20".

Parser generators? What's next? Java/C# instead of C?

Last time it took them six months to do so.

No, the vulnerability is about literal space.

It's _that_ old. As I know, 1.2.x actually is obsoleted since May 2013, and there is no more support or bugfixes after this date.

And even more: "send_timeout 2;" Mobile clients from another continent will "thank you" for this setting when they cannot open your site. "error_log /var/log/nginx/error.log crit;"…

What purpose of the article if in the documentation at nginx.org/en/docs/ you can find the same? And, btw, you are giving bad advices. You are wrong here: "By default, nginx sets o…