Live data from Hacker News

Show HN: Neverbleed – privilege separation engine for OpenSSL and LibreSSL

github.com

11–13 of 13 posts

Re: Show HN: Neverbleed – privilege separation engine for OpenSSL and LibreSSL

#11
post #10
post #9

Earlier quoted context omitted.

I assume you are referring to Keyless SSL. https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec... For Keyless SSL, it is necessary to make RSA operations asynchronous, since the operations are requested over the TCP network (which may have big delays). OTOH Neverbleed degelates the operations within the same server using Unix sockets. So there is no fear of such delays. And the server spawn a dedicated threa…

The point is that it requires TLS handshakes to be done in a multi-threaded system for a server handling high concurrency. Many servers are multi-threaded, but many are not. Using the proposed technique in a Node.js process, or nginx, is going to severely limit the number of new connections per second.

Wrong.

You seem to have confusion between TLS handshakes and RSA operations.

In OpenSSL (which is used by many servers including node.js, nginx), RSA operation is always synchronous. Therefore, using Neverbleed does not impose new limits regarding concurrency.

Re: Show HN: Neverbleed – privilege separation engine for OpenSSL and LibreSSL

#12
post #11
post #10

Earlier quoted context omitted.

The point is that it requires TLS handshakes to be done in a multi-threaded system for a server handling high concurrency. Many servers are multi-threaded, but many are not. Using the proposed technique in a Node.js process, or nginx, is going to severely limit the number of new connections per second.

Wrong. You seem to have confusion between TLS handshakes and RSA operations. In OpenSSL (which is used by many servers including node.js, nginx), RSA operation is always synchronous. Therefore, using Neverbleed does not impose new limits regarding concurrency.

Inter-process IPC is going to block the event loop for longer than a inline RSA operation.

Re: Show HN: Neverbleed – privilege separation engine for OpenSSL and LibreSSL

#13
post #12
post #11

Earlier quoted context omitted.

Wrong. You seem to have confusion between TLS handshakes and RSA operations. In OpenSSL (which is used by many servers including node.js, nginx), RSA operation is always synchronous. Therefore, using Neverbleed does not impose new limits regarding concurrency.

Inter-process IPC is going to block the event loop for longer than a inline RSA operation.

It is true that RSA operation over IPC is slower than doing it internally. But the latter is by magnitudes faster than the former, therefore the slowdown is negligible in practice.

You can find the numbers in the FAQ section of the linked website.

Post reply on HN