News for hackers. Stuff that matters.

A comment on Security advisory: Breach and Django. Parent comment

Re:Security advisory: Breach and Django by ludwigvan on Tuesday August 06, 2013 @02:23PM (#6168253)
Would this really work? Won't they be sharing cookies unless the static files are on a different domain?
[ Parent | on HN ]
Re:Security advisory: Breach and Django by agwa on Tuesday August 06, 2013 @02:25PM (#6168267)
Doesn't matter if they share cookies. Static files reflect neither user-supplied data nor secrets in their contents, so they can't be used in a BREACH attack.
[ Parent | on HN ]
Re:Security advisory: Breach and Django by andrewingram on Tuesday August 06, 2013 @02:34PM (#6168315)
Additionally, you should be serving static files from a different domain anyway so that you can get the performance gains from cookie-less requests.
[ Parent | on HN ]
Re:Security advisory: Breach and Django by bobwaycott on Tuesday August 06, 2013 @11:32PM (#6170660)
Can you point out some more info/sources on these performance gains?
[ Parent | on HN ]
Re:Security advisory: Breach and Django by andrewingram on Wednesday August 07, 2013 @04:25AM (#6171530)
https://developers.google.com/speed/docs/best-practices/requ...
[ Parent | on HN ]