Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nginx doesn't suck at SSL after all

matt.io

Post reply on HN
Print view View original

91–100 of 112 posts

Re: Nginx doesn't suck at SSL after all

#91

Post by kelnos »

tptacek wrote: post #62
benblack wrote: post #60

Earlier quoted context omitted.

Adam's post is rather more thorough and nuanced, which makes sense since he actually understands SSL and benchmarking. While you might summarize them both as "DHE is expensive", I don't know why you would. Here is each post on DHE: Adam - "However, with a pure RSA ciphersuite, an attacker can record traffic, crack (or steal) your private key at will and decrypt the traffic retrospectively, so consider your needs." Ma…

Are you a little worried that you come off sounding like "Adam is one of the cool kids and Matt isn't"? Matt's conclusion is ultimately correct. And we apparently disagree completely about DHE, because you appear to be saying you'd recommend it to web startups, despite the fact that the bank that clears those startups transactions isn't even using it. Especially weird given that Boundary, your startup, doesn't do DHE…

I think benblack's argument is that Adam can recommend disabling DHE because he knows what it is and what it does and can make an informed decision about whether or not your average SSL-enabled site needs it.

Matt simply says "I messed with my settings and leaving this one out makes it faster", without knowing whether or not turning DHE off is safe (or if he does know, clearly he's making it seem like he doesn't). The fact that it is safe -- in this instance -- isn't particularly relevant. The point is that someone who doesn't understand the security implications of something is making a recommendation about security, just cloaked in a recommendation about performance.

Anyway, I don't know any of the people we're talking about here, just trying to help clear up what I believe benblack was trying to say :)

Re: Nginx doesn't suck at SSL after all

#92

Post by tptacek »

kelnos wrote: post #91
tptacek wrote: post #62

Earlier quoted context omitted.

Are you a little worried that you come off sounding like "Adam is one of the cool kids and Matt isn't"? Matt's conclusion is ultimately correct. And we apparently disagree completely about DHE, because you appear to be saying you'd recommend it to web startups, despite the fact that the bank that clears those startups transactions isn't even using it. Especially weird given that Boundary, your startup, doesn't do DHE…

I think benblack's argument is that Adam can recommend disabling DHE because he knows what it is and what it does and can make an informed decision about whether or not your average SSL-enabled site needs it. Matt simply says "I messed with my settings and leaving this one out makes it faster", without knowing whether or not turning DHE off is safe (or if he does know, clearly he's making it seem like he doesn't). Th…

Right is right. Wrong is wrong. Pants aren't shirts. It's clear Ben doesn't think Matt is qualified to write the post. But he should have holstered the impulse to gripe about it until Matt wrote something wrong.

Re: Nginx doesn't suck at SSL after all

#93

Post by kronusaturn »

rythie wrote: post #68
ccollins wrote: post #14

From the article, to find out what your website is doing: openssl s_client -host HOSTNAME -port 443 I ran this for my own website and a few bigger websites openssl s_client -host www.gusta.com -port 443 (My site, hosted on Heroku) Cipher : DHE-RSA-AES256-SHA openssl s_client -host www.google.com -port 443 Cipher : RC4-SHA openssl s_client -host www.airbnb.com -port 443 Cipher : AES256-SHA openssl s_client -host www.f…

Presumably Amazon, Facebook and Google are using RC4 for speed reasons, though it's not really thought to be secure anymore.

RC4 has known weaknesses, but it's still extremely difficult to crack when implemented correctly. Attackers want to go for your weakest point, which is almost certainly not RC4; typically it's far more difficult to crack RC4 than to steal your data by finding a SQL injection or buffer overflow, or simply breaking into your building.

Re: Nginx doesn't suck at SSL after all

#94

Post by dfc »

This is why security is such a wierd/nice/confusing/irratating line of work to be in. Newsflash SSL is not a one size fits all secure you against anything technology. I did not see the original article so I won't pretend that I knew the answer ahead of time. I just hope that I did not accept SSL as being a onesize fits all completely uniform technical conmponent.

There is a Dave Chapelle joke about cops sprinkling crack-cocaine over a crime scene in order to make the case quick and easy. Too many developers trest SSL like magic pixie dust for security.

Or as ptacek says "thanks in advance for putting my kids through college."

Re: Nginx doesn't suck at SSL after all

#95

Post by benblack »

burgerbrain wrote: post #26
tptacek wrote: post #21

Earlier quoted context omitted.

nginx is a web server, like Apache. stud is a few hundred lines of trivial proxy code. And would you like to take a bet on how many lines of C code it would take to add support for configurable cipher suite modes in stud? Fair warning: I already know the answer to this (and I don't even know that stud doesn't allow it).

Do you happen to have a patch? I might be interested in that :)

Ask and ye shall receive: https://github.com/bumptech/stud/pull/6

stunnel DH code inserted into stud.

Re: Nginx doesn't suck at SSL after all

#96

Post by kelnos »

tptacek wrote: post #92
kelnos wrote: post #91

Earlier quoted context omitted.

I think benblack's argument is that Adam can recommend disabling DHE because he knows what it is and what it does and can make an informed decision about whether or not your average SSL-enabled site needs it. Matt simply says "I messed with my settings and leaving this one out makes it faster", without knowing whether or not turning DHE off is safe (or if he does know, clearly he's making it seem like he doesn't). Th…

Right is right. Wrong is wrong. Pants aren't shirts. It's clear Ben doesn't think Matt is qualified to write the post. But he should have holstered the impulse to gripe about it until Matt wrote something wrong.

Well, Matt did write something wrong. The original post about nginx "sucking" at SSL was wrong. Maybe it sucks for SSL in its default configuration (is that even that case, or was Matt's config copy/pasted from elsewhere?), but saying it sucks in general is incorrect and link-bait'y. You can presumably configure other web servers to suck just as much at SSL by enabling DHE ciphers and providing DH params.

Re: Nginx doesn't suck at SSL after all

#97

Post by burgerbrain »

tptacek wrote: post #54
burgerbrain wrote: post #41

Earlier quoted context omitted.

Their patchy security doesn't render his argument invalid. Edit: beachaccount: Financial institutions not using DHE is not a logically sound counter to "There's nothing wrong with using DHE algorithms, particularly if you're going to be transferring financial secrets around." While those institutions may chose not to, there is nothing wrong with others choosing otherwise . Additionally, patchy security on the part of…

"Patchy security"? What are you on about?

I'm refering to the portion of the comment I was responding to: "These "financial secrets" are emailed in the clear after every transaction"

The implication being that since they were sending the information in the clear in a separate part of their system, that they were wrong in configuring their https site as they did. I object to that conclusion.

Re: Nginx doesn't suck at SSL after all

#98

Post by tptacek »

kelnos wrote: post #96
tptacek wrote: post #92

Earlier quoted context omitted.

Right is right. Wrong is wrong. Pants aren't shirts. It's clear Ben doesn't think Matt is qualified to write the post. But he should have holstered the impulse to gripe about it until Matt wrote something wrong.

Well, Matt did write something wrong. The original post about nginx "sucking" at SSL was wrong. Maybe it sucks for SSL in its default configuration (is that even that case, or was Matt's config copy/pasted from elsewhere?), but saying it sucks in general is incorrect and link-bait'y. You can presumably configure other web servers to suck just as much at SSL by enabling DHE ciphers and providing DH params.

We're commenting on this blog post. As was Ben, who didn't comment on the previous post, but did single this one out here and, as I recall, on Twitter.

Re: Nginx doesn't suck at SSL after all

#99

Post by tptacek »

burgerbrain wrote: post #97
tptacek wrote: post #54

Earlier quoted context omitted.

"Patchy security"? What are you on about?

I'm refering to the portion of the comment I was responding to: "These "financial secrets" are emailed in the clear after every transaction" The implication being that since they were sending the information in the clear in a separate part of their system, that they were wrong in configuring their https site as they did. I object to that conclusion.

Ah. Patchy works there. I'm sorry about that. Having a hairtrigger day.

Re: Nginx doesn't suck at SSL after all

#100

Post by burgerbrain »

tptacek wrote: post #99
burgerbrain wrote: post #97

Earlier quoted context omitted.

I'm refering to the portion of the comment I was responding to: "These "financial secrets" are emailed in the clear after every transaction" The implication being that since they were sending the information in the clear in a separate part of their system, that they were wrong in configuring their https site as they did. I object to that conclusion.

Ah. Patchy works there. I'm sorry about that. Having a hairtrigger day.

No worries!
Post reply on HN