[1] http://tools.ietf.org/html/draft-montenegro-httpbis-speed-mobility-01
  [2] http://lists.w3.org/Archives/Public/ietf-http-wg/2012AprJun/0498
  [3] http://www.mnot.net/blog/2012/03/31/whats_next_for_http
  [4] http://librelist.com/browser//mongrel2/2011/8/17/opinions-about-spdy/#e67f0aaa71f4af3f0663195b99217f80

It might replace HTTP 1.1 if SSL certificates becomes free, automaticly generated, installed and renewed.

Otherwise most small websites (the majority of web sites on the net) without any real need for the security provided by encrypted communications (SSL) won't bother dealing with a ton of hassle (or costs) of SSL just for a minor speed improvement.

Also, many sites still serve up their unauthenticated homepages via http only, and such sites should have no problem checking for IE on XP and providing a link that'll work.

Depending on the nature of your traffic and how it arrives (e.g. via integration with third-party sites via scripts you've written), you might also have the opportunity to provide the appropriate fallback links to users before they ever reach your site for the first time.

And all of the above assumes you have enough IE-on-XP users to not just write them off entirely.

IMHO, SSL ought to use a fingerprint-comparison check, instead of a central cert. "This server has changed since last time. Is that OK?"

Using DNSSEC we can host the fingerprint of the cert in DNS at which point an CA is not required.

Honest question, myself being pretty new to cryptography.

In practice, you'd generally accept that the first one you receive is valid, and then watch for deviations from there.

This is the way SSH works, for instance.

- Data Link Layer (for instance Ethernet-Frames/Packets)

- IPv4/IPv6 - Packets

- TCP-Packets --> TCP-Stream

- SPDY-Frames --> Multiple Streams

- (Edit OK. Maybe not HTTP. Just insert here how they want to transmit the headers)

That way we not only send more useless data. We also have to dis- and reassemble everything twice.

Why not just extend the TCP-Protocol to support multiple streams? There's still unused space in the header and we have the possibility add additional options.

http://en.wikipedia.org/wiki/Transmission_Control_Protocol#T...

Am I missing something? I know that applications are not allowed to send raw TCP-Packets on most OSes by default. But most servers run Linux, which could be easily patched to support such additional features. (And webhosts will have some work to support that new protocol anyways)

I don't get it.

Edit: SCTP may be a suitable replacement for TCP as mentioned in some other comment. http://en.wikipedia.org/wiki/Stream_Control_Transmission_Pro...

gcc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Wunused-function -Wunused-variable -Wunused-value -Werror -g -march=native -Ofast -fomit-frame-pointer -fstack-protector -D_FORTIFY_SOURCE=2 -flto -fwhole-program -fuse-linker-plugin -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \ -o objs/src/http/ngx_http_spdy.o \ src/http/ngx_http_spdy.c

src/http/ngx_http_spdy.c: In function ‘ngx_http_init_spdy’:

src/http/ngx_http_spdy.c:261:34: error: variable ‘rc’ set but not used [-Werror=unused-but-set-variable]

src/http/ngx_http_spdy.c: In function ‘ngx_http_spdy_process_ping’:

src/http/ngx_http_spdy.c:1512:35: error: variable ‘c’ set but not used [-Werror=unused-but-set-variable]

src/http/ngx_http_spdy.c: In function ‘ngx_http_spdy_send_rst_stream’:

src/http/ngx_http_spdy.c:2552:35: error: variable ‘c’ set but not used [-Werror=unused-but-set-variable] cc1: all warnings being treated as errors

I would point out that the -Werror is set by the vanilla version of nginx and not a flag that I passed in.

Thanks for the quick turnaround. I got distracted with something else right after I posted this and didn't expect such a quick update.

In any case, -36 built just fine and I have verified that I now have SPDY on the server.

FWIW, the format of using

listen 443 spdy; ssl on;

works just fine too.

Chrome builds with -Werror on by default but, because of the above reason, recommends any person attempting to build it to turn it off (and provides a flag to do as much).

[1] http://en.wikipedia.org/wiki/SCTP