News for hackers. Stuff that matters.

A comment on Google disables compression for OpenSSL in Chrome - SSL exploit coming?.

Re:Google disables compression for OpenSSL in Chrome - SSL e... by alanh on Wednesday September 12, 2012 @06:53PM (#4513714)
Is this a disabling of compression on both ends? No DEFLATE on either requests or responses?

Will a site using HTTPS be able to serve compressed assets (like javascript & css)?

If not, we’ll urgently need a way for site devs to whitelist precomputed (and thus immune) static assets for compression.

[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by caf on Wednesday September 12, 2012 @10:37PM (#4514518)
It's a disabling of the optional compression at the TLS layer. HTTP content compression is not affected.
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by alanh on Wednesday September 12, 2012 @10:40PM (#4514524)
So what, exactly, is no longer compressed? Merely the headers themselves, and the content is not affected?
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by caf on Thursday September 13, 2012 @08:56PM (#4519493)
Pretty much, yes. With the proviso that if you didn't have HTTP Content-Type compression for your content before, then it might still have been compressed at the TLS layer, and won't be now.
[ Parent | on HN ]