it's not the cpu usage people worry about generally, it's the extra network trips / latency.

SPDY requires encryption and yet it's overall faster than HTTP. If you have HTTPS on you may as well serve your pages over SPDY to the browsers that support it

SPDY is less secure than HTTPS though[1]. Plus also supported by less web browsers / HTTP clients than HTTPS too.

[1] http://www.pcworld.com/article/262307/crime_attack_abuses_ss...

Did you even read the article you linked? The CRIME attack involves SSL/TLS, that both HTTPS and SPDY use.

The CRIME attack isn't just blindly attacking SSL/TLS like you rudely insinuated. CRIME specifically targets traffic over compressed SSL/TLS connections, using the deflation to leak cookies. The simple fix to this is to disable SSL/TLS compression, which is easily done in HTTPS (and in fact should be disabled if you want PCI compliance), but SSL/TLS compression cannot be disabled in SPDY.

Sorry I didn't categorically spell this out for you earlier, I forgot some people need spoon-feeding the facts about the technology they advocate - even after you've already cited a massively dumbed down article on the subject already.

(and nasty tone of my post is a result of me getting fed up with the way how you, and everyone else it seems, feels is appropriate to talk to each other on HN. This place never used to be quite so rude)

I'm sorry, I was certainly rude, please excuse me.