Showing posts with label SSL. Show all posts
Showing posts with label SSL. Show all posts

Thursday, July 10, 2014

SPDY, an experiemental web protocol to speed up HTTP

Page loading and latency are two of the important parameters in web traffic. If your page does not load under something like 4 sec, the surfer will go elsewhere. SPDY is all about reducing the page loading and improving latency. SPDY is a Google trade mark and it is still in experimentation.

Read this White paper to get a feeling for what is brewing:
http://dev.chromium.org/spdy/spdy-whitepaper

SPDY modifies the HTTP rather than replacing it and functions at the Session level. It functions as a tunnel for HTTP and HTTPs requests. HTTP 2.0 which in the works takes SPDY as a starting point.


Source: white paper

Basic Features(Google white Paper)
  • Multiplexed Streams
  • Request prioritization
  • HTTP Header compression
Google will try to get it standardized (in the works) and implementations exist for Chromium, Mozilla Firefox, Opera and other browsers including IE.

How is the speed achieved?
Latency reduction is acheived through compression, mulitplexing and prioritization (Basic features). The multiplexing is carried over one client connection for subweb resources instead of HTTP fetching one resource per connection.

Well how does HTTP with SPDY compares with HTTP?

Well web pages are complex constructs with images; style sheets; media etc fetched through connections slow and fast. It appears SDPY would work faster than HTTP in most cases.
Here is the performance comparison table from Google whitepaper:



Microsoft is also looking at SPDY and here is link to Microsoft research on comparing HTTP with SPDY and HTTP:

http://research.microsoft.com/pubs/170059/A%20comparison%20of%20SPDY%20and%20HTTP%20performance.pdf

Here is a performance chart for a popular web site (from Microsoft's PDF above):


Well we want to surf faster and with our Smartphones to get the same experience like the one on desktop something has to change.

Monday, May 05, 2014

Take care of HeartBleed bug, stop the flow

Heartbleed bug works on the vulnerabilities (missing bounds check in handling of the TLS heartbeat extension) in the popular OpenSSL crysptographic library. When the server is infected it can steal typically 64 chunks of information from HTTPS sites. SSL/TSL encryption data secures the information between you and your server for whatever application, be it be web, email, instant messaging and VPNs. Once stolen it can impersonate users to do further damage.

There has been a fix. Affected servers should upgrade their servers to 1.0.1g version. Most of them are trying to implement the fix and some seems to have already done it.

Testing in Filippo's online test site (next link in the post) the following institutions seems to have fixed the issue. You may feel safer if you are using these services. However double check with your institution.
https://filippo.io/Heartbleed/#www.Paypal.com:443

PayPal
Bank Of America
Bank Of Hawaii
Bethpage Federal Credit Union
T D Ameritrade
E*TRADE
draft.Blogger.com
Fidelity.com Login

For example PNC Bank at the time of this post does not give a 'clear' signal and other forces may be at work. Check it out on the FAQ page for Filippo's site here.

 
DMCA.com Protection Status