Hacker News Reader

Comment by applecore | Hacker News Reader

GraphQL doesn't transfer raw bytes, so they would save the 33% overhead if they weren't using Base64 binary-to-text encoding.

View on HN

Gzip content encoding recovers most of the overhead.

Except they shouldn't really use Gzip if they are also using HTTPS.... See http://stackoverflow.com/a/4063496/171237 or look up BREACH and CRIME.

BREACH/CRIME aren't a huge concern here. Unlike in a web browser, an attacker can't cause a user's browser to fire off crafted requests (because they're only occurring in the Facebook app, which doesn't let third-party scripts run), and they can't easily observe the size of requests and responses (because they're all happening over a cellular network, which is difficult to sniff).

Running inside the app is probably the strongest argument here, though I think that's also kinda assuming that people cannot subvert the app in unexpected ways. The size of requests can still be observed e.g. being on Wifi - people don't just use their Smartphone from the cellular network.

My thinking is that while in this case it's "probably safe" to use Gzip + HTTPS, but that's not a good practice to build secure systems. If e.g. here these requests are exempted and run to Gzip, the reasons and circumstances for doing it here will be forgotten, and can end up with other stuff exempted later which shouldn't. Just from experience how things work in large orgs.

"Good thing" they aren't using HTTPS for Internet.org then.

Reply on news.ycombinator.com