Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is a great write up.

Also, for those saying that TLS is a panacea: encrypting and/or HMAC'ing all TCP data in and out of a box is operationally ridiculous unless you're in some sort of ultra high security environment.



Sorry, what's ridiculous about it? It's a very achievable thing. On modern CPUs with instruction support, AES encryption can be done faster than DRAM bandwidth. There are definitely latency costs in connection setup that will penalize "transaction-like" protocols I guess. It's not 100% free, but relative to the other performance issues you're looking at it's surely way way way down the list of priorities.


Please note my use of the word 'operationally'.


How does that change things? What's "operationally" ridiculous about it?


The overhead involved in piling on encryption management in an environment that doesn't specifically warrant it is a waste of resources.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: