A good day to trie-hard: saving compute 1% at a time

Re:A good day to trie-hard: saving compute 1% at a time by hinkley on Tuesday September 10, 2024 @12:35PM (#41502671)

And what would you have them do instead? SSL to every service? Reauthenticate on every single call? What’s your clever solution?

There’s probably a dozen things you can terminate at a boundary that would cost so much to run through the entire system that it would bankrupt a company.

And then there’s tracing, which also uses headers.

[ Parent | on HN ]

Re:A good day to trie-hard: saving compute 1% at a time by immibis on Tuesday September 10, 2024 @01:07PM (#41503050)

one of the listed options was to begin all the Cloudflare internal header names with "CFInt"

[ Parent | on HN ]

Re:A good day to trie-hard: saving compute 1% at a time by hinkley on Tuesday September 10, 2024 @01:13PM (#41503120)

That’s still header filtering. And it should be X-CF- by the way.

[ Parent | on HN ]

Re:A good day to trie-hard: saving compute 1% at a time by faitswulff on Tuesday September 10, 2024 @02:12PM (#41503817)

It took me about 10 years to hear about it, but the IETF tried to deprecate the X- prefix back in 2012: https://datatracker.ietf.org/doc/html/rfc6648

[ Parent | on HN ]

Re:A good day to trie-hard: saving compute 1% at a time by hinkley on Tuesday September 10, 2024 @02:43PM (#41504144)

Good to know.

(Also sibling is right, I spaced on X-CF- being a header sent to CF customers’ servers. I don’t used cloudflare but cloudfront does the exact same thing)

[ Parent | on HN ]

Re:A good day to trie-hard: saving compute 1% at a time by amluto on Tuesday September 10, 2024 @01:24PM (#41503247)

X-CF- seems to be used by some other software. And Cloudflare has plenty of documented headers that don’t start with X.

The whole point is that a genuine user header should never conflict with a Cloudflare internal header, and a browser should never see an internal header.

[ Parent | on HN ]

Re:A good day to trie-hard: saving compute 1% at a time by sitkack on Tuesday September 10, 2024 @01:45PM (#41503506)

Having re-read the thread, I totally agree. What you have listed is table stakes. I'd also say that internal headers would also be encrypted to a narrow protection domain.

If all internal headers were prefixed with X-CF-, you could strip them all via SIMD that had no knowledge of any specific header. Hell, you could probably do it on the NIC.

[ Parent | on HN ]

Re:A good day to trie-hard: saving compute 1% at a time by hinkley on Tuesday September 10, 2024 @01:30PM (#41503315)

Please reread the entire thread. We are talking about someone who thinks the header solution is stupid. You are both splitting hairs. Stay on target.

[ Parent | on HN ]

Re:A good day to trie-hard: saving compute 1% at a time by 8n4vidtmkvmk on Wednesday September 11, 2024 @01:31AM (#41508280)

Maybe I'm dumb or missing something, but why not just do what Google does -- convert all inbound HTTP requests into Protobufs, separate out the internal stuffs from the external stuffs, run it through your myriad of internal services, and then on the way out you still have your nicely delineated protobufs which you can convert back into HTTP. Why are we mucking about with headers in the first place?

[ Parent | on HN ]