Nginx 1.5.10 released with SPDY 3.1 support • Hacker News Board

Re: Nginx 1.5.10 released with SPDY 3.1 support

#11

Post by BobVerg » Tue, Feb 04, 2014, 6:23 PM UTC

bungle wrote: post #5

d0ugie wrote: post #3

Nice, Nginx! Anyone know if this version of Nginx comes with SPDY enabled? If so can it be installed with SPDY enabled in binaries through package managers, and if not, should 1.5.10 be compiled using --with-http_ssl_module and --with-http_spdy_module in order to take advantage of this? If someone compiles 1.5.10 without that argument and then one day decides he wants to light up SPDY, does he need to recompile Nginx…

Yes, it works with their official packages, at least. Just updated today. Here is the basic config I'm using with it: listen x.x.x.x:443 default_server deferred spdy; listen [x:x:x:x::x]:443 default_server deferred spdy ipv6only=on; spdy_headers_comp 7; ssl on; ssl_certificate /etc/ssl/private/x.crt; ssl_certificate_key /etc/ssl/private/x.key; ssl_trusted_certificate /etc/ssl/private/x.trust; ssl_protocols TLSv1 TLSv…

"spdy_headers_comp 7;" looks like huge overkill. It provides about 10% better compression ratio than setting 1, but two times slower.

Re: Nginx 1.5.10 released with SPDY 3.1 support

#12

Post by nodesocket » Tue, Feb 04, 2014, 6:27 PM UTC

BobVerg wrote: post #11

bungle wrote: post #5

Earlier quoted context omitted.

Yes, it works with their official packages, at least. Just updated today. Here is the basic config I'm using with it: listen x.x.x.x:443 default_server deferred spdy; listen [x:x:x:x::x]:443 default_server deferred spdy ipv6only=on; spdy_headers_comp 7; ssl on; ssl_certificate /etc/ssl/private/x.crt; ssl_certificate_key /etc/ssl/private/x.key; ssl_trusted_certificate /etc/ssl/private/x.trust; ssl_protocols TLSv1 TLSv…

"spdy_headers_comp 7;" looks like huge overkill. It provides about 10% better compression ratio than setting 1, but two times slower.

I was wondering why by default it is 0/off. Are there issues with client/browser compatibility?

Re: Nginx 1.5.10 released with SPDY 3.1 support

#13

Post by pixl97 » Tue, Feb 04, 2014, 6:30 PM UTC

nly wrote: post #7

bungle wrote: post #5

Earlier quoted context omitted.

Yes, it works with their official packages, at least. Just updated today. Here is the basic config I'm using with it: listen x.x.x.x:443 default_server deferred spdy; listen [x:x:x:x::x]:443 default_server deferred spdy ipv6only=on; spdy_headers_comp 7; ssl on; ssl_certificate /etc/ssl/private/x.crt; ssl_certificate_key /etc/ssl/private/x.key; ssl_trusted_certificate /etc/ssl/private/x.trust; ssl_protocols TLSv1 TLSv…

Any specific reason why you went for an STS timeout of 6 months?

SSL Labs test will not give you a A+ rating if it is not set at least that long. HSTS headers should always be set for a long period of time to avoid a client that only rarely connects to a site having a MITM attack occur.

Re: Nginx 1.5.10 released with SPDY 3.1 support

#14

Post by BobVerg » Tue, Feb 04, 2014, 6:46 PM UTC

nodesocket wrote: post #12

BobVerg wrote: post #11

Earlier quoted context omitted.

"spdy_headers_comp 7;" looks like huge overkill. It provides about 10% better compression ratio than setting 1, but two times slower.

I was wondering why by default it is 0/off. Are there issues with client/browser compatibility?

It's because of CRIME vulnerability.

Re: Nginx 1.5.10 released with SPDY 3.1 support

#15

Post by conductor » Tue, Feb 04, 2014, 6:58 PM UTC

nodesocket wrote: post #10

bungle wrote: post #5

Earlier quoted context omitted.

Yes, it works with their official packages, at least. Just updated today. Here is the basic config I'm using with it: listen x.x.x.x:443 default_server deferred spdy; listen [x:x:x:x::x]:443 default_server deferred spdy ipv6only=on; spdy_headers_comp 7; ssl on; ssl_certificate /etc/ssl/private/x.crt; ssl_certificate_key /etc/ssl/private/x.key; ssl_trusted_certificate /etc/ssl/private/x.trust; ssl_protocols TLSv1 TLSv…

What does the following header do? add_header Alternate-Protocol 443:npn-spdy/3; Also, what exactly does deferred do on the listen directive?

This is from the section 3.3.1 of SPDY Protocol - Draft 2 [0]:

"When a server receives a non-SPDY request which could have been served via SPDY, it should append a Alternate-Protocol header into the response stream. Note that it is valid to have multiple Alternate-Protocols headers. The field-value can also be specified as a comma-separated list, as per RFC2616 section 4.2."

And you can read about "deferred" here: https://stackoverflow.com/questions/8449058/what-does-the-de...

[0] - http://dev.chromium.org/spdy/spdy-protocol/spdy-protocol-dra...

Re: Nginx 1.5.10 released with SPDY 3.1 support

#16

Post by fafner » Tue, Feb 04, 2014, 7:47 PM UTC

Just in time for Firefox 27 with SPDY 3.1 support https://www.mozilla.org/en-US/firefox/27.0/releasenotes/

Re: Nginx 1.5.10 released with SPDY 3.1 support

#17

Post by wiremine » Tue, Feb 04, 2014, 9:17 PM UTC

I'm still new to SPDY, although I'm going to check it out with this release. Are there any best practices or recommendations for running SPDY in production alongside HTTP?

Re: Nginx 1.5.10 released with SPDY 3.1 support

#18

Post by nodesocket » Tue, Feb 04, 2014, 9:42 PM UTC

BobVerg wrote: post #14

nodesocket wrote: post #12

Earlier quoted context omitted.

I was wondering why by default it is 0/off. Are there issues with client/browser compatibility?

It's because of CRIME vulnerability.

More information about CRIME. http://en.wikipedia.org/wiki/CRIME_(security_exploit) For now, disabling SPDY header compression is the right approach. Security > Performance.

Re: Nginx 1.5.10 released with SPDY 3.1 support

#19

Post by elithrar » Tue, Feb 04, 2014, 11:50 PM UTC

conductor wrote: post #15

nodesocket wrote: post #10

Earlier quoted context omitted.

What does the following header do? add_header Alternate-Protocol 443:npn-spdy/3; Also, what exactly does deferred do on the listen directive?

This is from the section 3.3.1 of SPDY Protocol - Draft 2 [0]: "When a server receives a non-SPDY request which could have been served via SPDY, it should append a Alternate-Protocol header into the response stream. Note that it is valid to have multiple Alternate-Protocols headers. The field-value can also be specified as a comma-separated list, as per RFC2616 section 4.2." And you can read about "deferred" here: ht…

> And you can read about "deferred" here: https://stackoverflow.com/questions/8449058/what-does-the-de...

Thanks for the link; I'm curious as to the downsides however (the article linked in the article doesn't fully cover them), and a Google search doesn't yield anything concrete (i.e. deferred on vs. off).

Re: Nginx 1.5.10 released with SPDY 3.1 support

#20

Post by mfjordvald » Wed, Feb 05, 2014, 2:09 AM UTC

d0ugie wrote: post #3

Nice, Nginx! Anyone know if this version of Nginx comes with SPDY enabled? If so can it be installed with SPDY enabled in binaries through package managers, and if not, should 1.5.10 be compiled using --with-http_ssl_module and --with-http_spdy_module in order to take advantage of this? If someone compiles 1.5.10 without that argument and then one day decides he wants to light up SPDY, does he need to recompile Nginx…

> If someone compiles 1.5.10 without that argument and then one day decides he wants to light up SPDY, does he need to recompile Nginx or is there a quicker solution? Thanks!

In Vanilla nginx said user would need to recompile yes. Do note that the make file contains an 'upgrade' target, though, which performs a seamless binary upgrade.