Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSL revisited

varnish-cache.org

Post reply on HN
Print view View original

61–69 of 69 posts

Re: SSL revisited

#61

Post by phkamp »

viraptor wrote: post #59

> The most obvious example is that you don't want to bog down your countrys civil defence agency with SSL/TLS protocol negotiations, if their website is being deluged by people trying to survive a natural disaster. On the other hand, I don't want China to bog down some contry's civil defence (or any other website) by DDOSing it, injecting JS into unencrypted baidu traffic. Which one is causing more problems right now…

Right now, the biggest problem is the unlimited invasion of privacy done by transnational companies accountable to nobody.

NSA could, in theory, be reigned in by the government, but nobody in the world has the power to stop the transnational companies deconstruction of everybodys indentities.

For instance, I have never agreed to FaceBook's terms and conditions, but they track me, like everybody else.

Re: SSL revisited

#62

Post by phkamp »

viraptor wrote: post #58
phkamp wrote: post #22

Earlier quoted context omitted.

Let me just make absolutely clear: It's not my opinion that certain people don't deserve privacy, it is the law of the land, duly enacted and ratified by legitimate governments. If you want to change that, vote.

What does that mean then? > But one of the biggest problem I have with SSL Everywhere is that it gives privacy to the actors I think deserve it the least. Some deserve privacy more than others? How does that work?

How many mentions do companies get in national constitutions ?

They're not mentioned one single time in the US or the Danish Constitutions, yet, both countries they more or less run government now.

UN's human rights don't mention them either.

Companies have no claim to human rights, like privacy, because they are not humans.

And if you think all humans, no matter what, should have a universal, unabbridgable right to privacy: Vote in your elections, and if nobody is worthy of your vote, get yourself elected instead.

But right now there are fully valid laws that says certain classes of humans do not get privacy, and the government which enacted those laws are legit, elected and have every right to enforce their laws.

Re: SSL revisited

#63

Post by phkamp »

tacos wrote: post #55
phkamp wrote: post #53

Earlier quoted context omitted.

So we have established that your factual knowledge of varnish is severely lacking (and/or skewed) and now you just demonstrated that you have no idea who you are lambasting either. Let me know if you ever want to have a fact-based discussion, in the meantime, don't get cold up there, on your high horse. I gave a talk called "NSA Operation Orchestra" some time ago, I recommend you watch it, it might give you something…

See, that's just the thing. I tuned Varnish for 32 bit machines (a terrible idea), I sent in patches. I love everything about OpenBSD. I think the NSA are a bunch of cocksuckers. And I also think that when you combine all those things in a post talking about a feature decision it makes you look like a lunatic. Talk to Percival, he gets it. And thank you for the work on Varnish, it seriously saved several sites.

So what you're saying is that because you disagree with me, I'm a terrible person ?

Needless to say, I don't agree.

Re: SSL revisited

#64

Post by phkamp »

clinta wrote: post #56
phkamp wrote: post #52

Earlier quoted context omitted.

HTTPS doesn't provide authentication. It only communicates authentication, and that is from the untrustworthy and widely trojned CA-concept, which is as broken as it almost can be. There are other, far better authentication methods for things like emergency services, and I'd rather have unauthenticated information, than no information at all anyway. You also don't need authentication to stop ISP's being stupid, for t…

As bad as the CA system is, I have not seen evidence that it's 'widely trojaned' or broken. The fact that a falsely minted certificate is such big news is evidence to the fact that it is working pretty well despite it's flaws. And it is certainly better than no authentication at all. Obviously it's not perfect, but being not perfect is no excuse for refusing to use what we've got right now. And it's not a choice of u…

And you think NSA with their enormous budget and a mandate to collect "everything" looks askance at the CA's and go "Nope!" ?

Really ?

How many of the root-certs that are in your browser by default do you actually trust ?

What objective evidence is there, that any of them can be trusted ?

Re: SSL revisited

#65

Post by faker_ »

phkamp wrote: post #64
clinta wrote: post #56

Earlier quoted context omitted.

As bad as the CA system is, I have not seen evidence that it's 'widely trojaned' or broken. The fact that a falsely minted certificate is such big news is evidence to the fact that it is working pretty well despite it's flaws. And it is certainly better than no authentication at all. Obviously it's not perfect, but being not perfect is no excuse for refusing to use what we've got right now. And it's not a choice of u…

And you think NSA with their enormous budget and a mandate to collect "everything" looks askance at the CA's and go "Nope!" ? Really ? How many of the root-certs that are in your browser by default do you actually trust ? What objective evidence is there, that any of them can be trusted ?

Nobody says that. We are all aware of that. But we shouldn't make it easier for our local ISPs or WiFi access operators to spy on us. Because those very probably don't have the CAs compromised.

Re: SSL revisited

#66

Post by faker_ »

phkamp wrote: post #23
floatboth wrote: post #10

Earlier quoted context omitted.

This. Google measured TLS overhead on their servers – it was very small. If you can do TLS on Google scale, you can do it anywhere.

Are you willing to pay increased taxes, so that FEMA (Or your countrys similar) can afford to run 100.000 servers, in order to "do TLS on Google scale", so that they can get emergency orders out for civil defence ? Have your forgotten (or maybe never seen ?) CNN's traffic graph from 9/11 ? Experience so far is that emergency services web-pages tend to die the instant they are most needed. Addint TLS will just make th…

You really need to update your facts. CPU overhead is already less than 1%. https://istlsfastyet.com/

Re: SSL revisited

#67

Post by mike-cardwell »

We don't need Varnish anymore, we have Nginx now. Does anyone here use Varnish because Nginx isn't good enough? If so, what is Varnish better at than Nginx, and by how much?

Re: SSL revisited

#68

Post by viraptor »

phkamp wrote: post #62
viraptor wrote: post #58

Earlier quoted context omitted.

What does that mean then? > But one of the biggest problem I have with SSL Everywhere is that it gives privacy to the actors I think deserve it the least. Some deserve privacy more than others? How does that work?

How many mentions do companies get in national constitutions ? They're not mentioned one single time in the US or the Danish Constitutions, yet, both countries they more or less run government now. UN's human rights don't mention them either. Companies have no claim to human rights, like privacy, because they are not humans. And if you think all humans, no matter what, should have a universal, unabbridgable right to…

I get that at the moment some don't get privacy. I meant the "deserve it the least" part. It seems to contradict "It's not my opinion that certain people don't deserve privacy".

I don't think deserving privacy has a scale. I understand your "deserve least" as "I'd rather they didn't have privacy". Feel free to correct me.

Re: SSL revisited

#69

Post by marcosdumay »

stephenr wrote: post #39
marcosdumay wrote: post #21

I can sympathize with the author's feeling. TLS is incredibly complex. It seems that TLS libraries are all bad, setting them up is incredibly difficult, and hell, all the complaints about OpenSSL are not enough to do justice to its quality. But no, Varnish is the optimal point for doing encryption, and placing anything on its front is contrary to any reason somebody would have to use it.

What makes varnish more optimal than a dedicated tls termination and load balancing layer?

After you add all that, what are you using Varnish for? Cache? Placing your cache at the load balancing instead of fetching pages from the network does actually save processing and memory.

If you use Varnish, it's almost certainly sitting at the best point for doing TLS termination.

Post reply on HN