News for hackers. Stuff that matters.
Re:Security advisory: Breach and Django by maciejgryka on Tuesday August 06, 2013 @01:56PM (#6168086)
You can still safely compress your static files. So, assuming that you don't send any secrets in your CSS, JS etc., you can configure your server to enable gzip only for these resources.

For example, when using nginx and with gzip off globally, you can do :

    location /static/ {
        gzip on;
        ...
    }
Re:Security advisory: Breach and Django by ludwigvan on Tuesday August 06, 2013 @02:23PM (#6168253)
Would this really work? Won't they be sharing cookies unless the static files are on a different domain?
Re:Security advisory: Breach and Django by agwa on Tuesday August 06, 2013 @02:25PM (#6168267)
Doesn't matter if they share cookies. Static files reflect neither user-supplied data nor secrets in their contents, so they can't be used in a BREACH attack.
Re:Security advisory: Breach and Django by andrewingram on Tuesday August 06, 2013 @02:34PM (#6168315)
Additionally, you should be serving static files from a different domain anyway so that you can get the performance gains from cookie-less requests.
Re:Security advisory: Breach and Django by bobwaycott on Tuesday August 06, 2013 @11:32PM (#6170660)
Can you point out some more info/sources on these performance gains?
Re:Security advisory: Breach and Django by andrewingram on Wednesday August 07, 2013 @04:25AM (#6171530)