Hacker News Reader

Comment by Argorak | Hacker News Reader

PHK discusses a lot of these point here: http://www.infoq.com/presentations/HTTP-Performance (especially his views on encryption)

(sorry for the repost, this wasn't posted when I posted the other one)

View on HN

This is probably a better link: https://www.varnish-cache.org/docs/trunk/phk/http20.html There's a lot of fairly concrete issues in there, concrete suggestions for improvements, concrete suggestions for better problems to focus on (it's hard to overestimate how important that is for proper engineering!), and it's in text instead of a 40 minute video.

I disagree, the link is also interesting, but as I said further down: the video holds an interesting discussion of his views on encryption, especially end-to-end, something the parent explicitly discussed.

So as a problem, he lists server push. What other proposals are there to get rid of stuff like spritesheets?

Just saw it. Basically he's an advocate of the "only bad guys want privacy everywhere".

I still have not seen a single proposal from him that is not "forget about crypto", or "let everything be tracked".

He doesn't seems to even understand how basic key exchange work, and all his arguments boil down to "I think they can break it anyway, so we should stop using it".

IMHO, forget about him. he has no proposal and his understanding of security and crypto is downright dangerous.

You obviously havn't spent much time looking either, have you?

You could look at section 15 here for instance: http://phk.freebsd.dk/words/httpbis.html

With respect to key-exchange, maybe the problem is that I do understand, and therefore know that there is a difference between privacy and secrecy ?

Some places we want privacy, some places we want secrecy.

Mandating privacy everywhere makes it almost mandatory for police-states to trojan the privacy infrastructure (ie: CA's -- yes they already did), and therefore we have neither privacy nor secrecy anymore.

PS: Dangerous for who ?

PPS": Google "Operation Orchestra" if you don't undstand the previous question.

Police-States would try to trojan the CA infrastructure anyway – its too much tempting a target.

Inspecting proxies work well enough with HTTP 1.1, there's no real need to improve them, and even if we do, it should be done via a proxy mechanism, rather than via sending more things in plaintext than we have.

Anyway, HTTPS routers can (and should) terminate SSL, and in that case they can even read the Host from SNI.

Privacy isn't a binary. Neither is secrecy. It's a function of relationships.

So the question isn't whether children have privacy, but against whom are they able to be private, in what regard? While I'm generally ok with parents knowing where their kids are, I'm not as ok with a random creep in the neighborhood knowing.

As far as criminals and prisoners, it's far more granular than that. If I get caught shoplifting, does that suddenly mean all my medical records are up for grabs? If I am a prisoner, am I allowed to refuse to see someone who comes to visit me?

Reply on news.ycombinator.com