Announcing SPDY draft 2 implementation in nginx | Hacker News Reader

Announcing SPDY draft 2 implementation in nginx

mailman.nginx.org

145 pointslysol28 comments

This is a big deal, I think. Ten years from now we're going to look back and discover that Google quietly replaced HTTP without anybody complaining, or even noticing.

I agree it's a big deal, but I wouldn't say people aren't noticing[1][2][3] or complaining[4].

  [1] http://tools.ietf.org/html/draft-montenegro-httpbis-speed-mobility-01
  [2] http://lists.w3.org/Archives/Public/ietf-http-wg/2012AprJun/0498
  [3] http://www.mnot.net/blog/2012/03/31/whats_next_for_http
  [4] http://librelist.com/browser//mongrel2/2011/8/17/opinions-about-spdy/#e67f0aaa71f4af3f0663195b99217f80

I was thinking more in terms of the average-joe consumer, but then I guess the average-joe consumer never knew what HTTP was anyway.

Sure they do, it is that thing in front of the hard to type portion of urls.

I think adoption is driven by real needs and we need SPDY as much as we needed HTML5.

It won't replace HTTP 1.1, since billions of small sites without SSL certificates can't use it.

It might replace HTTP 1.1 if SSL certificates becomes free, automaticly generated, installed and renewed.

Otherwise most small websites (the majority of web sites on the net) without any real need for the security provided by encrypted communications (SSL) won't bother dealing with a ton of hassle (or costs) of SSL just for a minor speed improvement.

Free SSL certificates already exist, accepted by all major browsers: https://www.startssl.com/ . Does having to visit that site once a year to renew a certificate really pose a hardship?

That, and having to have a dedicated ip address due to IE on XP's lack of SNI support.

IE on XP will never support SPDY, so just fall back to HTTP for IE on XP. :)

But how do you do that? You'd have to have a non-https based landing page and then redirect to spdy based on user agent. If you actually care about SSL, the non-SSL landing page is an attack vector.

You could serve up HSTS records via http, which IE on XP doesn't support either. That'll ensure that all of your repeat visitors use https directly.

Also, many sites still serve up their unauthenticated homepages via http only, and such sites should have no problem checking for IE on XP and providing a link that'll work.

Depending on the nature of your traffic and how it arrives (e.g. via integration with third-party sites via scripts you've written), you might also have the opportunity to provide the appropriate fallback links to users before they ever reach your site for the first time.

And all of the above assumes you have enough IE-on-XP users to not just write them off entirely.

The other article on SPDY complained about it having SSL enabled by default. Is that really something to complain about? Isn't it one of the good things about it, because if SPDY gets adopted, it means everything becomes encrypted? And isn't that a very desirable future?

Having things encrypted is good, yes, but requiring people to get a certificate means that the web has fewer chokepoints, which is bad.

IMHO, SSL ought to use a fingerprint-comparison check, instead of a central cert. "This server has changed since last time. Is that OK?"

What about the first time the user connects, how would they be assured that the fingerprint really is the site's and not a man in the middle?

Honest question, myself being pretty new to cryptography.

In theory, you could do an out-of-band comparison.

In practice, you'd generally accept that the first one you receive is valid, and then watch for deviations from there.

This is the way SSH works, for instance.

http://www.imperialviolet.org/2011/06/16/dnssecchrome.html

Using DNSSEC we can host the fingerprint of the cert in DNS at which point an CA is not required.

How is that a question that any end-user could be expected to answer with any kind of authority?

Wait. Did I just read that right? They want to emulate a packet (or frame) based protocol on top of a stream protocol (TCP-Stream) which itself uses packets? That adds umm... how many overhead? Lets count:

- Data Link Layer (for instance Ethernet-Frames/Packets)

- IPv4/IPv6 - Packets

- TCP-Packets --> TCP-Stream

- SPDY-Frames --> Multiple Streams

- (Edit OK. Maybe not HTTP. Just insert here how they want to transmit the headers)

That way we not only send more useless data. We also have to dis- and reassemble everything twice.

Why not just extend the TCP-Protocol to support multiple streams? There's still unused space in the header and we have the possibility add additional options.

http://en.wikipedia.org/wiki/Transmission_Control_Protocol#T...

Am I missing something? I know that applications are not allowed to send raw TCP-Packets on most OSes by default. But most servers run Linux, which could be easily patched to support such additional features. (And webhosts will have some work to support that new protocol anyways)

I don't get it.

Edit: SCTP may be a suitable replacement for TCP as mentioned in some other comment. http://en.wikipedia.org/wiki/Stream_Control_Transmission_Pro...

SCTP requires OS support... putting SDPY on top of TCP/IP is just like any other protocol and doesn't require adding an entire new protocol that will have to be firewalled, will have to traverse across different devices that may or may not have SCTP available (such as older consumer routers).

For everyone who tries to build this: the URL to the patch file is http://nginx.org/patches/spdy/patch.spdy-35.txt, and not the one mentioned in the announcement.

It fails to build for me. Got a bunch of warnings being treated as errors.

gcc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Wunused-function -Wunused-variable -Wunused-value -Werror -g -march=native -Ofast -fomit-frame-pointer -fstack-protector -D_FORTIFY_SOURCE=2 -flto -fwhole-program -fuse-linker-plugin -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \ -o objs/src/http/ngx_http_spdy.o \ src/http/ngx_http_spdy.c

src/http/ngx_http_spdy.c: In function ‘ngx_http_init_spdy’:

src/http/ngx_http_spdy.c:261:34: error: variable ‘rc’ set but not used [-Werror=unused-but-set-variable]

src/http/ngx_http_spdy.c: In function ‘ngx_http_spdy_process_ping’:

src/http/ngx_http_spdy.c:1512:35: error: variable ‘c’ set but not used [-Werror=unused-but-set-variable]

src/http/ngx_http_spdy.c: In function ‘ngx_http_spdy_send_rst_stream’:

src/http/ngx_http_spdy.c:2552:35: error: variable ‘c’ set but not used [-Werror=unused-but-set-variable] cc1: all warnings being treated as errors

I would point out that the -Werror is set by the vanilla version of nginx and not a flag that I passed in.

Warnings are compiler version dependent (and even optimization level dependent, surprisingly). It looks like that one was introduced by gcc 4.6, so perhaps the author of the patch was using a different version.

Chrome builds with -Werror on by default but, because of the above reason, recommends any person attempting to build it to turn it off (and provides a flag to do as much).

Thanks, fixed. =) Try again: http://nginx.org/patches/spdy/ patch.spdy-36.txt or later revision.

LOL.

Thanks for the quick turnaround. I got distracted with something else right after I posted this and didn't expect such a quick update.

In any case, -36 built just fine and I have verified that I now have SPDY on the server.

FWIW, the format of using

listen 443 spdy; ssl on;

works just fine too.

I hope SCTP[1] starts to take off soon as a transport for protocols like this, so they don't have to keep working around the limitations of TCP.

[1] http://en.wikipedia.org/wiki/SCTP

Date of the first RFC is from 2000. I wouldn't hold my breath. Besides, SPDY enablement simply relies on browser / middleware updates changes which can iterate quickly compared to networking gear that needs to support the protocol shift. This was a large factor in building SPDY on top of an existing stack.

Look at how old IPv6 is, and how long it took to get people to start deploying.

It was much easier to get this working than I thought it would be! Does anyone know when this will be part of an official release?

Reply on news.ycombinator.com