Hacker News Reader

Comment by wbond | Hacker News Reader

Interesting to see that now the current stable versions of Chrome and Firefox have dropped spdy/2, which is the only version of spdy supported by the current stable version of nginx. And nginx is the server used by more than 90% of hosts supporting spdy[1]. I presume this means it is mostly a Google/Twitter/Cloudflare thing for now since they seem to all be running spdy/3.1 in production.

[1] http://w3techs.com/technologies/segmentation/ce-spdy/web_ser...

View on HN

Speaking as a Chromium SPDY & HTTP/2 developer, we are very much focused on standardization. SPDY is an experimental protocol meant to drive the standards process, not become a de facto standard itself. Therefore, it's critical for us to kill off old SPDY versions.

For more discussion on this topic, please refer to these discussion threads: https://groups.google.com/forum/#!topic/spdy-dev/_uvxTJkeCP0 https://groups.google.com/forum/#!topic/spdy-dev/XDudMZSq3e4

And note that your reference is slightly misleading (I don't think you intended this). It's true, the vast majority of hosts supporting SPDY are running nginx. In practice though, the vast majority of these hosts are Cloudflare or WordPress.com hosted sites. Both run newer versions of nginx with SPDY/3.1 support.

Right, so my point stands that it is interesting that current stable browsers don't support current stable web servers. So unless someone has the resources to test and deploy unstable web servers, it effectively means you shouldn't bother with spdy at this point.

I think it's a fair assessment that supporting experimental technologies requires more engineering resources. Everyone has to do the cost/benefit analysis themselves.

You seem intent on arguing about something I have never contested.

I just made the (implied) observation that anyone deploying nginx shouldn't even bother enabling spdy in 1.4 (stable) because effectively nothing will use it anymore. It was something that people who use "stable" software were able to benefit from starting in May 2013, but it is now no longer and won't be again until nginx reaches 1.6. That is, unless spdy/3 is dropped in favor of spdy/4 by then.

(edit: fixed date)

I think for people who actually want spdy3 support, they will evaluate whether nginx 1.5 is stable enough for them. Stable is just a word, and unless it's a straightjacket "stable or nothing" culture you're referring to, yes people will have to make their own decisions about whether 1.5 is stable enough for their needs.

As the posts below, "mainline" is considered stable enough for production.

A rose by any other name?

Well, the difference is that breaking changes are made to 1.5 so when a security update comes out (like today) you have to do regression testing instead of just grabbing and building the latest version.

Er, I thought I was agreeing with you. What do you think I'm arguing? To be clear, I view these two statements as grounded in the same logic, although perhaps one is more strongly worded than the other:

Yours - "So unless someone has the resources to test and deploy unstable web servers, it effectively means you shouldn't bother with spdy at this point."

Mine - "I think it's a fair assessment that supporting experimental technologies requires more engineering resources. Everyone has to do the cost/benefit analysis themselves."

Let me rephrase then:

Don't even bother building nginx 1.4 with spdy support or configuring it since no one can use it. From May 2013 until now there was a benefit to end-users. There no longer is.

If you want to provide the speed benefits of spdy to users, you now need to run unstable nginx or mod_spdy.

Right. I think the point is that you shouldn't be relying on experimental standards for one's web architecture unless you recognize its experimental status.

As an outside observer, it seems like this kind of pattern happens pretty regularly on HN. It's always kind of funny. There seems to be two distinct flavors:

Pattern 1:

    > Statement
    >> Counterstatement!
    >>> You're saying the same thing.
    >>>> I am? Oh. I *am*. Whoops!

Pattern 2:

    > Statement
    >> Agree with tone of disagreement.
    >>> Disagree on disagreement, while offering up facts to somehow agree *harder*
    >>>> Rebuttal, optional restatement of disagreement, optional statement(s) further
    >>>> reinforcing the common point on which we just can't agree to agree

Nginx has had spdy3.1 support since late Jan, 2014, starting with nginx 1.5.10 (don't use that version, read on).

The current nginx 1.5.12 has patches to fix an overflow issue with the spdy support so it's gotten at least some attention paid to it since the feature was released. I expect spdy3.1 support will only get better as more and more people move to the latest version of nginx.

Check http://nginx.org/en/CHANGES for the changelog.

The 'mainline' branch of nginx which supports spdy/3 is not considered unstable and can be used in production.

Source: http://forum.nginx.org/read.php?2,221377,221390#msg-221390

Except when a security patch comes out and the API changed between security releases and you have to potentially update configuration and fix third-party modules.

I don't think people that are running Nginx with spdy are doing so with the stable version. I started using spdy back when it was a patch you had to manually apply, before compiling Nginx.

Count me as one of those people who doesn't like to have to work around backwards compatibility breaks when installing security patches on production servers. :-)

(edit: clarified wording)

There's always HTTP 1.1 available for the people that don't want the burdein of being on the leading edge (yep, I'm on that team).

Anyway, doesn't spdy/2 have a huge security flaw in certificate management? I don't remember it well. If that's the case, it's good that they droped it.

These days you just have compile it with --with-http_spdy_module in configure step. (for the current 1.4.6-stable). We were about to go into production but will hold it off.

Also the current mainline 1.5 version has implementation of spdy/3.

Chrome has also dropped support for SPDY/2 https://en.wikipedia.org/wiki/SPDY#Protocol_versions

Reply on news.ycombinator.com