Hacker News Reader

The largest security issue with SPDY was CRIME, which was specifically caused by a gzip-compress-then-encrypt problem with the HTTP headers (which can contain attacker controlled info).

The switch to HPACK for header compression resolved this. SPDY/HTTP2 has no currently known security flaws.

View on HN

Exactly - and that's why we have SPDY header compression disabled on our nginx config:

https://github.com/18F/tls-standards/blob/master/configurati...

When SPDY 4 or HTTP/2 make their way into an nginx module, we'll upgrade, and turn header compression back on.

Er, so I take this back? Ilya Grigorik rang in and told me I wasn't distinguishing between request and response headers:

https://github.com/18F/tls-standards/issues/24

Reply on news.ycombinator.com