Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netflix now supports TLS 1.3

netflixtechblog.com

Post reply on HN
Print view View original

91–100 of 141 posts

Re: Netflix now supports TLS 1.3

#91

Post by anchpop »

vinay_ys wrote: post #87

It is interesting to see the experiment results with 7%-8% improvements in media rebuffers with just moving from 1-RTT to 0-RTT. Wonder if they ever considered having only one layer of encryption instead of two (TLS and DRM). Would that save more CPU and hence avoid media rebuffers lot more?

DRM is required by the people they licence video from. I imagine that they wouldn't do it if they didn't have to. (They might still do it to their own content but I don't see what they gain by doing it for someone else's)

Re: Netflix now supports TLS 1.3

#92

Post by Thaxll »

vinay_ys wrote: post #87

It is interesting to see the experiment results with 7%-8% improvements in media rebuffers with just moving from 1-RTT to 0-RTT. Wonder if they ever considered having only one layer of encryption instead of two (TLS and DRM). Would that save more CPU and hence avoid media rebuffers lot more?

But those 2 layers are at different level, one is for content the other for the HTTP protocol.

Re: Netflix now supports TLS 1.3

#93

Post by Rebelgecko »

MaxBarraclough wrote: post #5

I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. As I understand it, they use HTTPS to prevent spying and data-mining by unscrupulous ISPs. It doesn't affect their DRM at all, which would work just as well over plain HTTP.

>given that the data they're dealing with is films and TV shows, rather than, say, payment details.

I definitely have had to enter payment details on Netflix.com before

Re: Netflix now supports TLS 1.3

#94

Post by rechristened »

MaxBarraclough wrote: post #49
CydeWeys wrote: post #32

Earlier quoted context omitted.

Are you hinting at something here, some threat maybe, that you think Netflix is responding to? Or do you just not think that more security is a good thing generally and should be done for its own sake?

It's possible to distribute large binary blobs over unencrypted HTTP, and to provide security using hash checks. I believe apt no longer does this due to a flaw in their implementation that would not have been an issue if they'd used HTTPS. I'm unsure if Steam still uses insecure HTTP, but they certainly used to. [0] [1] I'm all for HTTPS everywhere, but for Netflix and YouTube, that means encrypting exabytes of data…

How are you distributing the hashes?

Re: Netflix now supports TLS 1.3

#95

Post by Rebelgecko »

anchpop wrote: post #91
vinay_ys wrote: post #87

It is interesting to see the experiment results with 7%-8% improvements in media rebuffers with just moving from 1-RTT to 0-RTT. Wonder if they ever considered having only one layer of encryption instead of two (TLS and DRM). Would that save more CPU and hence avoid media rebuffers lot more?

DRM is required by the people they licence video from. I imagine that they wouldn't do it if they didn't have to. (They might still do it to their own content but I don't see what they gain by doing it for someone else's)

IIRC, Amazon Prime actually uses less obnoxious DRM on their own content than for 3rd party stuff.

At least, when I had a computer configuration that they said was unsupported for HD due to DRM reasons, I was still able to get Amazon's own videos in 1080p

Re: Netflix now supports TLS 1.3

#96

Post by elithrar »

__s wrote: post #56

Can someone explain why this thread is full of people not caring about security? This article even goes over how TLS 1.3 is a perf improvement Have the anti privacy crowd come out in droves now that we have a public desire for contact tracing & there's a desire to scapegoat why netflix et al have reduced stream quality due to increased load? & HTTP is not an option. I for one enjoy my ISP not being able to inject ads…

> why netflix et al have reduced stream quality due to increased load?

This is not quite true - it's less about _Netflix's_ load and more about load on the _access networks_ (end-user ISPs).

They are seeing longer peaks, increased congestion (fewer folks are leaving their homes), and thus the reduction in default streaming quality by many streaming platforms was a move to limit congestion on these last-mile networks (and some IXs) where possible.

The EU & India anticipated the most congestion here, which is why you likely saw these announcements start with the EU before becoming global, as other ISPs/IXs/govts began to think about the same.

Disclosure: I work for Google in this space, but don't represent them here.

Re: Netflix now supports TLS 1.3

#97

Post by dang »

__s wrote: post #56

Can someone explain why this thread is full of people not caring about security? This article even goes over how TLS 1.3 is a perf improvement Have the anti privacy crowd come out in droves now that we have a public desire for contact tracing & there's a desire to scapegoat why netflix et al have reduced stream quality due to increased load? & HTTP is not an option. I for one enjoy my ISP not being able to inject ads…

You're probably running into the contrarian dynamic: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... Your comment is a great example of the second wave: objections to the objections, getting upvoted to the top of the thread. (Edit: it's no longer at the top, see explanation below.)

Comment threads don't represent the community view. They self-select for commenters who object to something. This is particularly true early on, since objecting is usually a reflex reaction that leads to quick comments. Reflective comments, the better kind, take longer to appear—because reflection is a slower cognitive process and because they take longer to write. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

The third wave is people looking around and not seeing the second-wave description of the thread really matching the comments (we got one of those too: https://news.ycombinator.com/item?id=22935245). That's because the original objections have since been supplemented by more interesting comments that were slower to roll in. It may also be because the janitors a.k.a. moderators have been active in the thread, sweeping up and so on.

Edit: Speaking of janitorial work, I've downweighted this subthread now, which is one of the things we do. Check out the effect: at least as of this moment, if you scroll back to the top, notice how much more enticing and curious the conversation is, than if this were the first thing were seeing. It's as if the thread can breathe.

Re: Netflix now supports TLS 1.3

#98

Post by elithrar »

MaxBarraclough wrote: post #5

I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. As I understand it, they use HTTPS to prevent spying and data-mining by unscrupulous ISPs. It doesn't affect their DRM at all, which would work just as well over plain HTTP.

> I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details.

I can't speak for all of Netflix's motivations, but one of the biggest for OTT platforms is preventing MitM of your streams by middle-proxies - including ISPs.

That MitM prevention encompasses data mining/user privacy, ad injection/replacement, and maintaining control over stream quality (Quality of Experience).

There used to be [and still is, in some places] a lot of transcode-to-lower-bitrate-and-cache-inside-our-network behaviour, especially amongst mobile carriers. Reduced stream quality would reflect on Netflix, not the ISP who might be doing this transparently. A user switching up to 1080p or expecting 4K HDR (as appropriate) wants to get that, and Netflix [or others] want to deliver that experience as intended.

The reason we see a LOT less of this now is due to how easy (and thus, widespsread) TLS became.

Re: Netflix now supports TLS 1.3

#99

Post by adamduren »

user5994461 wrote: post #73
__s wrote: post #56

Can someone explain why this thread is full of people not caring about security? This article even goes over how TLS 1.3 is a perf improvement Have the anti privacy crowd come out in droves now that we have a public desire for contact tracing & there's a desire to scapegoat why netflix et al have reduced stream quality due to increased load? & HTTP is not an option. I for one enjoy my ISP not being able to inject ads…

Who cares about security in the real world? Have you tried googling "should I use SSL"? The top answer is a stackoverflow answer saying no way. "Putting SSL everywhere is only a way to get a warm fuzzy feeling on security that is no good. It [SSL] is usually only used as a distraction allowing administrators to disregard actual security issues." https://stackoverflow.com/questions/2177159/should-all-sites...

I wonder if accepted answers with negative upvotes still display at the top on SO... Only one way to find out.
Post reply on HN