BobVerg

5 ms·

1.
by BobVerg 13y ago
15,000 pageviews per day == just 10-20 views per minute. Very low load actually.
2.
by BobVerg 13y ago
CRIME attack isn't specific to request or response. If you pass secrets in response headers, then the attack can be performed against them.
3.
by BobVerg 13y ago
It's because of CRIME vulnerability.
4.
by BobVerg 13y ago
"spdy_headers_comp 7;" looks like huge overkill. It provides about 10% better compression ratio than setting 1, but two times slower.
5.
by BobVerg 13y ago
There are official Linux packages with the latest version: http://nginx.org/en/linux_packages.html#mainline
6.
by BobVerg 13y ago
Ok. To exploit any vulnerability the attacker have to do something. It's just obvious. I don't understand what you're trying to make clear. > and attacker handcraft an http request packet, bypassing encode and sanity check
7.
by BobVerg 13y ago
A few quotes from the link, if you didn't read: "Some checks on a request URI were not executed on a character following an unescaped space character (which is invalid per HTTP protocol, but allowed for compatibility reasons since
8.
by BobVerg 13y ago
No, it won't be %20. It isn't encoded. You should mkdir or touch "name ", not "name%20".
9.
by BobVerg 13y ago
Parser generators? What's next? Java/C# instead of C?
10.
by BobVerg 13y ago
Last time it took them six months to do so.
11.
by BobVerg 13y ago
No, the vulnerability is about literal space.
12.
by BobVerg 13y ago
It's _that_ old. As I know, 1.2.x actually is obsoleted since May 2013, and there is no more support or bugfixes after this date.
13.
by BobVerg 13y ago
And even more: "send_timeout 2;" Mobile clients from another continent will "thank you" for this setting when they cannot open your site. "error_log /var/log/nginx/error.log crit;" A way to
14.
by BobVerg 13y ago
What purpose of the article if in the documentation at nginx.org/en/docs/ you can find the same? And, btw, you are giving bad advices. You are wrong here: "By default, nginx sets our keep-alive timeout to 75s (in this co