Hacker News Reader

Comment by stephen_g | Hacker News Reader

I really don't understand this bit:

> Local governments have no desire to spend resources negotiating SSL/TLS with every single smartphone in their area when things explode, rivers flood, or people are poisoned.

I remember some concerns about performance of TLS five to ten years ago, but these days is anybody really worried about that? I remember seeing some benchmarks (some from Google when they were making HTTPS default, as well as other people) that it hardly adds a percent of extra CPU or memory usage or something like that.

Also, these days HTTPS certificates can be had for similar prices to domains, and hopefully later this year the Let's Encrypt project should mean free high quality certificates are easily available.

With that in mind, forcing HTTPS is pretty much going to be only a good thing.

View on HN

On my load balancers it is more like 5-10%. Not terrible, but not trivial either. Also, it multiplies throughout the environment. If you are dealing with PII or financials, everything needs to be encrypted on the wire.

Load balancer decrypts, looks at headers, decides what to do, re-encrypts, down to the app tier, decrypt, respond encrypted, etc. I'm not saying that is a bad thing, but that's why some people get cranky.

Somewhat unrelated, compressed headers in HTTP 2.0 makes sense if you only think about the browser, it saves 'repeated' information. The problem is the LB has to decrypt them every time anyways, so someone still have to do the work, it just isn't on the wire. Server push on the other hand could be awesome for performance (pre-cache the resources for the next page in a flow) but also has the potential for abuse.

> If you are dealing with PII or financials, everything needs to be encrypted on the wire.

Well I hope you'd be doing that even without HTTP/2...

Why not just run unencrypted behind the load balancer? Unless they're on wholely different networks, it shouldn't be needed.. SSL termination makes sense at a load balancer, reverse proxy, etc.

PCI.

Like how Google used to do it? http://cdn01.androidauthority.net/wp-content/uploads/2014/06...

Even if not the CPU cost, I don't think small-town, USA IT wants to deal with incompatibilities between clients when SSL is enforced (ie. no SNI on pre-GB Android phones/winXP, only some [weak] ciphers available in IE etc) not necessarily the individual compute increase.

To address what you've said, increasing the energy consumption of every internet connected device in the world will probably have noticeable effects on the aggregate (more power for the server, more power to cool the server, etc.).

“small-town, USA IT” has to outsource as much as possible anyway because their budgets have been cut annually for a long time. Spending an extra $100/year on an SSL certificate is the least of their worries if they're not simply using outside services for as much as possible.

> increasing the energy consumption of every internet connected device in the world will probably have noticeable effects on the aggregate

How would this compare to the energy used by e.g. a single wasteful banner ad campaign? Do you really think that it makes sense to be concerned with the part which is increasingly executed by optimized hardware?

The point is that such applications have no use for privacy, so why should it be forced? (NB: I am not asking this question, just explaining the point)

"No use" is not correct. For instance, an attacker could MITM a critical info service and provide malicious instructions.

Reply on news.ycombinator.com