Re:Uses For A Message Queue
by Spearchucker on Wednesday December 12, 2012 @04:21AM
(#4909307)
It is indeed heavy, and I avoid it for both performance and payload size, and more importantly, because some implementations of SSL have vulnerabilities. Others may have. The generalisation of the protocol I use is well known -
A -> R: A, B
R -> A: {A,B,Kᴬᴮ,T}ᴷᴬᴿ,{A,B,Kᴬᴮ,T}ᴷᴮᴿ
A -> B: {A,B,Kᴬᴮ,T}ᴷᴮᴿ,{M}ᴷᴬᴮ
Where A = Alice, B = Bob, R = Robert, K = key, T = time stamp, M = message
A planning system that uses my store and forward implementation is used by a defence force, and went through some pretty thorough accreditation.
As for your willingness to farm this out to a third party - hey that's cool. It is, after all, a commodity service. Personally? I prefer to avoid dependencies on third parties where I can, because I'm not comfortable with the longer-term versioning dependencies, patch management and general operational support that's added over and above my code, which must already be supported.
And just as I let TCP do this for me at a lower layer, I'd personally be quite happy to farm this out to a queue library or service. That a problem has been solved in a well-known pattern, and that I could solve it with my own code, doesn't mean that I ought to spend time and effort doing so.
> security (encrypting a bitstream without requiring SSL). Because of this I wrote a library that I simply drop into every one of my mobile app projects.
I am wary of not using SSL. I mean it's a heavy protocol, but that's what you need to rebuff the many, many clever attacks against homegrown protocols.
Recently I filed a patent for a protocol involving cryptographic elements and it took me 11 goes-around with a Well-Known Expert to get a protocol that wasn't basically retarded beyond all comprehension. This after spending a year reading about crypto and security for my honours project. I tried, but really, it's one of those topics where soaking for a few years pays and being out of the loop for a month can cost.
Anyhow. I guess my question is, why not use SSL? Performance/battery life?