SSL revisited
varnish-cache.org
SSL revisited
1–10 of 69 posts
Re: SSL revisited
#2I'm not sure how I feel about the Political PostScript section. It raises the following points against the concept of "SSL Everywhere":
- "you don't want to bog down your countrys civil defence agency with SSL/TLS protocol negotiations if their website is being deluged by people trying to survive a natural disaster"
- "there are people who do not have a right to privacy"
- "SSL Everywhere will force institutions to either block any internet connectivity or impose Man-in-The-Middle proxies"
- "SSL Everywhere [gives privacy] to the actors I think deserve it the least"
- "shady behaviour of big transnational, and therefore law-less, companies have been exposed by security researchers (or just interested lay-people) who ran tcpdump"
- "SSL Everywhere puts all traffic in the shade"
--------
My opinion:
Without TLS, the Internet is either read-only or has reasonably high security risk.
I also noticed varnish-cache.org was served to me over TLS.
Re: SSL revisited
#3Without discussing any of the political points (which felt out of place), this simply means that we will continue to not use Varnish.
Nginx' caching is good enough that it's not worth the pain of trying to implement some wacky setup just to use Varnish.
Re: SSL revisited
#4I'm not sure how I feel about the Political PostScript section. It raises the following points against the concept of "SSL Everywhere": - "you don't want to bog down your countrys civil defence agency with SSL/TLS protocol negotiations if their website is being deluged by people trying to survive a natural disaster" - "there are people who do not have a right to privacy" - "SSL Everywhere will force institutions to e…
> SSL Everywhere will force institutions to either block any internet connectivity or impose Man-in-The-Middle proxies
MITM proxies are already how many organizations handle web filtering. (aka "transparent proxies") TLS just necessitates that the organization have some control over the device being MITM'd to do so. (to install their cert)
Re: SSL revisited
#5I'm not sure how I feel about the Political PostScript section. It raises the following points against the concept of "SSL Everywhere": - "you don't want to bog down your countrys civil defence agency with SSL/TLS protocol negotiations if their website is being deluged by people trying to survive a natural disaster" - "there are people who do not have a right to privacy" - "SSL Everywhere will force institutions to e…
If a federal site can survive being DDOSed, it can probably survive normal traffic.
And I fundamentally disagree with the premise that there are people who do not deserve privacy. I can not think of a single person I would wish complete exposure of their lives upon.
Re: SSL revisited
#6I'm not sure how I feel about the Political PostScript section. It raises the following points against the concept of "SSL Everywhere": - "you don't want to bog down your countrys civil defence agency with SSL/TLS protocol negotiations if their website is being deluged by people trying to survive a natural disaster" - "there are people who do not have a right to privacy" - "SSL Everywhere will force institutions to e…
[deleted]
Re: SSL revisited
#7> The most obvious example is that you don't want to bog down your countrys civil defence agency with SSL/TLS protocol negotiations, if their website is being deluged by people trying to survive a natural disaster.
If TLS overhead is the last straw that brings down a web site, the site's infrastructure isn't suitable for delivering safety-critical information.
Re: SSL revisited
#8I'm not sure how I feel about the Political PostScript section. It raises the following points against the concept of "SSL Everywhere": - "you don't want to bog down your countrys civil defence agency with SSL/TLS protocol negotiations if their website is being deluged by people trying to survive a natural disaster" - "there are people who do not have a right to privacy" - "SSL Everywhere will force institutions to e…
If a federal site can survive being DDOSed, it can probably survive normal traffic. And I fundamentally disagree with the premise that there are people who do not deserve privacy. I can not think of a single person I would wish complete exposure of their lives upon.
Some people do not have the rights to online privacy. For example, when accessing a website from the library of a jail. The authorities want and need to know what you do, this for some obvious and understandable reasons. I agree this is a particular case, but this is still a case for allowing a website (as long as this is anonymous usage of it) to be available without SSL.
Re: SSL revisited
#9Without discussing any of the political points (which felt out of place), this simply means that we will continue to not use Varnish. Nginx' caching is good enough that it's not worth the pain of trying to implement some wacky setup just to use Varnish.
It's straightforward to run Pound or HAProxy in front of Varnish to provide SSL-terminatation. I wouldn't consider it a wacky setup. The performance gains over Nginx for static/anonymous caching is significant.
Re: SSL revisited
#10> The most obvious example is that you don't want to bog down your countrys civil defence agency with SSL/TLS protocol negotiations, if their website is being deluged by people trying to survive a natural disaster. If TLS overhead is the last straw that brings down a web site, the site's infrastructure isn't suitable for delivering safety-critical information.
This. Google measured TLS overhead on their servers – it was very small. If you can do TLS on Google scale, you can do it anywhere.