Hacker News Reader

Is it safe to use SPDY implementation at that point? I've seen critical flaws in the past...

The largest security issue with SPDY was CRIME, which was specifically caused by a gzip-compress-then-encrypt problem with the HTTP headers (which can contain attacker controlled info).

The switch to HPACK for header compression resolved this. SPDY/HTTP2 has no currently known security flaws.

Exactly - and that's why we have SPDY header compression disabled on our nginx config:

https://github.com/18F/tls-standards/blob/master/configurati...

When SPDY 4 or HTTP/2 make their way into an nginx module, we'll upgrade, and turn header compression back on.

Er, so I take this back? Ilya Grigorik rang in and told me I wasn't distinguishing between request and response headers:

https://github.com/18F/tls-standards/issues/24

Reply on news.ycombinator.com