| 00:36.39 | *** join/#uphpu bbankes (~bbankes@67-2-219-238.slkc.qwest.net) |
| 01:48.57 | *** join/#uphpu macnewbold (~macnewbol@c-24-2-87-227.hsd1.ut.comcast.net) |
| 01:49.04 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 02:00.34 | *** join/#uphpu PoeticIntensity (~jason@c-50-186-111-109.hsd1.ut.comcast.net) |
| 02:00.34 | *** mode/#UPHPU [+v PoeticIntensity] by ChanServ |
| 02:09.20 | *** join/#uphpu _carbohydrate (~textual@206.251.47.14) |
| 02:11.34 | *** join/#uphpu bbankes (~bbankes@67-2-219-238.slkc.qwest.net) |
| 02:36.36 | mindjuju | <PROTECTED> |
| 02:37.53 | herlo | nope, just us fishes. |
| 02:38.50 | mindjuju | hey, on a 301 redirect, it looks like the request comes into the server, the server sees the request should be 301 and changes the URL and passes the requested item, right? |
| 02:39.15 | mindjuju | i mean, the server doesn't get the 301, and send the updated info to the client, who then rerequests at the new address |
| 02:40.37 | herlo | should, I think |
| 02:40.37 | mindjuju | well, not if, but how |
| 02:41.18 | mindjuju | i saw the ceo of backcountry today, she seems really cool |
| 02:43.43 | mindjuju | so herlo, ccraze is wanting to put everythin over https (helps google page rank), now my spidey sense says: if few files for webpage, then :); but if many many files for webpage then very :( |
| 02:43.53 | mindjuju | because each would have an ssl transaction |
| 02:51.33 | *** join/#uphpu mgeary_ (~mgeary@107.188.169.107) |
| 02:51.33 | *** mode/#UPHPU [+v mgeary_] by ChanServ |
| 02:58.41 | herlo | ssl everywhere is fine |
| 03:18.54 | *** join/#uphpu clintberry (~clintberr@38.73.150.199) |
| 03:19.04 | *** mode/#UPHPU [+v clintberry] by ChanServ |
| 03:53.39 | stevecoug | mindjuju: if you set it up right, you really just have a single SSL transaction |
| 03:54.08 | stevecoug | When you first connect, you do the SSL handshake, but then that connection is kept alive and used for more requests |
| 03:55.32 | herlo | that's the standard configuration, btw. |
| 03:56.16 | stevecoug | If you do additional connections, your server should be able to shortcut the SSL transaction using session tickets, but if you have multiple servers you need a way to cache them across the cluster (or make sure a single session doesn't go to multiple servers) |
| 03:56.43 | stevecoug | herlo: the second part is what I meant by "if you set it up right" |
| 03:58.28 | herlo | :D |
| 04:18.20 | *** join/#uphpu TuxToaster (~TuxToaste@inferno.apxalarm.com) |
| 04:18.21 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 04:41.42 | *** join/#uphpu itimber (~Adium@ip72-209-186-65.ks.ks.cox.net) |
| 04:41.42 | *** mode/#UPHPU [+v itimber] by ChanServ |
| 04:44.14 | *** join/#uphpu mgeary_ (~mgeary@107.188.169.107) |
| 04:44.15 | *** mode/#UPHPU [+v mgeary_] by ChanServ |
| 05:31.21 | *** join/#uphpu supernovia (~Adium@2605:a601:525:d001:28e4:a564:db88:182d) |
| 06:45.18 | mgeary_ | hey mindjuju |
| 06:45.57 | mgeary_ | canât i hop online in the evening without there being a problem? ;) |
| 13:36.28 | *** join/#uphpu _carbohydrate (~textual@206.251.47.14) |
| 14:12.50 | *** join/#uphpu supernovia (~Adium@2605:a601:525:d001:8e2:5961:3bd8:eeed) |
| 14:12.58 | *** join/#uphpu macnewbold (~macnewbol@inferno.apxalarm.com) |
| 14:12.58 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 14:23.16 | *** join/#uphpu UtahDave (~boucha@rrcs-198-24-97-2.central.biz.rr.com) |
| 14:23.16 | *** mode/#UPHPU [+o UtahDave] by ChanServ |
| 14:33.28 | *** join/#uphpu _carbohydrate (~textual@192.150.9.201) |
| 14:47.18 | *** join/#uphpu MikeHansenMe (~mike@c-76-27-9-26.hsd1.ut.comcast.net) |
| 15:09.56 | *** join/#uphpu josephscott (~josephsco@192.0.65.252) |
| 15:09.56 | *** mode/#UPHPU [+o josephscott] by ChanServ |
| 15:15.21 | *** join/#uphpu Heartsbane (tsharpe@shell.xmission.com) |
| 15:15.21 | *** join/#uphpu Heartsbane (tsharpe@unaffiliated/heartsbane) |
| 15:15.21 | *** mode/#UPHPU [+v Heartsbane] by ChanServ |
| 15:19.13 | *** join/#uphpu eggyknap (~jtolley@184-11-47-170.dr01.dlta.ut.frontiernet.net) |
| 15:19.13 | *** join/#uphpu eggyknap (~jtolley@unaffiliated/eggyknap) |
| 15:19.13 | *** mode/#UPHPU [+v eggyknap] by ChanServ |
| 15:23.03 | *** join/#uphpu itimber (~Adium@ip72-209-186-65.ks.ks.cox.net) |
| 15:23.03 | *** mode/#UPHPU [+v itimber] by ChanServ |
| 15:40.37 | *** join/#uphpu macnewbold (~macnewbol@inferno.apxalarm.com) |
| 15:40.37 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 16:07.58 | *** join/#uphpu TuxToaster (~TuxToaste@inferno.apxalarm.com) |
| 16:07.58 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 16:11.16 | *** join/#uphpu _carbohydrate (~textual@192.150.9.201) |
| 16:26.23 | *** join/#uphpu itimber (~Adium@ip72-209-186-65.ks.ks.cox.net) |
| 16:26.24 | *** mode/#UPHPU [+v itimber] by ChanServ |
| 16:27.47 | *** join/#uphpu clintberry (~clintberr@205.197.215.90) |
| 16:27.47 | *** mode/#UPHPU [+v clintberry] by ChanServ |
| 16:40.37 | *** join/#uphpu bbankes (~bbankes@50-200-100-242-static.hfc.comcastbusiness.net) |
| 17:13.56 | *** join/#uphpu itimber (~Adium@ip72-209-186-65.ks.ks.cox.net) |
| 17:16.07 | *** mode/#UPHPU [+v itimber] by ChanServ |
| 17:51.28 | *** join/#uphpu beandog (~beandog@gentoo/developer/beandog) |
| 17:51.28 | *** mode/#UPHPU [+v beandog] by ChanServ |
| 17:53.28 | beandog | Is it possible to have multiple SPF records? |
| 17:53.33 | beandog | Or do they all need to get crammed into one DNS entry |
| 17:53.49 | herlo | I think you can have multiple. |
| 17:55.50 | jsmith | If I remember correctly, some clients don't deal well with multiples :-( |
| 17:56.03 | jsmith | (and some clients don't handle switching over to TCP for overly-large records either) |
| 18:04.14 | beandog | I'd feel bad for you if I understood that. |
| 18:04.26 | beandog | :) |
| 18:06.49 | jsmith | So, quick lesson |
| 18:07.00 | jsmith | DNS requests usually go out over UDP packets (fire and forget!) |
| 18:07.29 | jsmith | but if they are to big, they need to be split across multiple TCP packets (make sure each packet gets there and re-ordered properly) |
| 18:07.45 | jsmith | Some clients don't like doing DNS over TCP and fail miserably |
| 18:07.54 | jsmith | Luckily, it's becoming less and less common to see that |
| 18:09.36 | beandog | hmm |
| 18:09.36 | beandog | intresting |
| 18:09.51 | beandog | So, basically, I can block all UDF traffic and enjoy the mess? |
| 18:10.08 | beandog | *packets |
| 18:29.26 | jsmith | Something like that, yes |
| 18:46.08 | *** join/#uphpu josephscott (~josephsco@192.0.65.252) |
| 18:46.08 | *** mode/#UPHPU [+o josephscott] by ChanServ |
| 18:52.11 | *** join/#uphpu _carbohydrate (~textual@192.150.9.201) |
| 19:00.46 | *** join/#uphpu Oberon4278 (~dcrooksto@38.112.155.163) |
| 19:27.08 | fungus | the SPF spec allows for an include: so you can break up the record over several. |
| 19:27.28 | fungus | see `dig txt _spf.google.com` |
| 19:41.57 | *** join/#uphpu itimber (~Adium@ip72-209-186-65.ks.ks.cox.net) |
| 19:41.57 | *** mode/#UPHPU [+v itimber] by ChanServ |
| 19:58.08 | jsmith | fungus: Right... that doesn't mean everybody else handles it well |
| 19:58.38 | fungus | true |
| 20:47.41 | *** join/#uphpu itimber (~Adium@ip72-209-186-65.ks.ks.cox.net) |
| 20:47.41 | *** mode/#UPHPU [+v itimber] by ChanServ |
| 20:48.16 | *** join/#uphpu _carbohydrate (~textual@192.150.9.201) |
| 21:05.10 | *** join/#uphpu _carbohydrate (~textual@192.150.9.201) |
| 21:22.39 | mindjuju | it's too bad beandog left, i just finished a big thing on spf |
| 21:22.57 | mindjuju | the answer is, 1 spf for 1 domain, subdomains need their own spf |
| 21:23.15 | mindjuju | but you shouldn't have 2 spf for example.com |
| 21:23.43 | mindjuju | anybody have a minute that wants to look at ssl connections with me? |
| 21:25.54 | *** part/#uphpu littleSkinner (~JSkinn@asa-2.fbp.ore.fiber.net) |
| 21:26.32 | mindjuju | well, if anybody gets a minute, i'm trying to determine why the ssl time is taking so long |
| 21:26.36 | mindjuju | http://www.webpagetest.org/result/141010_KE_19Z9/1/details/ |
| 21:38.18 | josephscott | mindjuju: did you run it through https://www.ssllabs.com/ssltest/index.html already? |
| 21:39.39 | josephscott | can you reduce the cert chain? |
| 21:41.04 | mindjuju | i was just starting to look at that josephscott |
| 21:41.27 | mindjuju | oh actually i wasn't not the chains, i was looking at cyphers |
| 21:41.31 | josephscott | did you try it with other browsers besides IE 9? |
| 21:41.51 | mindjuju | i didn't |
| 21:42.10 | josephscott | you may also want to try it without traffic shaping, to see what a test with maxed out speed would look like |
| 21:42.41 | josephscott | you can also opt to do a tcpdump capture, which can provide more details on the HTTPS exchange and setup |
| 21:43.01 | josephscott | wireshark can read the dump for you |
| 21:44.46 | mindjuju | so josephscott, reduction of cert chain is = http://blog.cloudflare.com/what-we-just-did-to-make-ssl-even-faster/ |
| 21:44.48 | josephscott | looks like you are using Apache, this might be worth while to read - http://unhandledexpression.com/2013/01/25/5-easy-tips-to-accelerate-ssl/ |
| 21:45.15 | josephscott | actually I was looking at the test results - https://www.ssllabs.com/ssltest/analyze.html?d=secure.costumecraze.com&hideResults=on |
| 21:45.25 | josephscott | under "Additional Certificates" |
| 21:45.32 | josephscott | Certificates provided4 (4915 bytes) |
| 21:45.56 | mindjuju | that link you sent over about the cyphers, that's the one that gave me the idea :) |
| 21:46.16 | mindjuju | is there a way to reduce the cert chain? i thought i needed the gdbundle |
| 21:46.35 | mindjuju | (please nobody attack me about godaddy, it's not my call, i've argued that they are the devil) |
| 21:46.56 | josephscott | you might, I don't know, but it is worth checking |
| 21:47.19 | mindjuju | i'll look into that |
| 21:47.28 | josephscott | in some cases they'll just give everyone a bundle to include, with multiple certs, even though you might only need one out of the bundle |
| 21:47.45 | mindjuju | oh gotcha |
| 21:47.55 | josephscott | I also highly recommend the book "High Performance Browser Networking" |
| 21:48.02 | josephscott | by Ilya Grigorik at Google |
| 21:48.15 | josephscott | you can read the whole thing online for free - http://chimera.labs.oreilly.com/books/1230000000545/index.html |
| 21:49.26 | josephscott | the first part may be a rehash of basic networking stuff |
| 21:49.47 | josephscott | but still good, I read it cover to cover, highly recommend it |
| 22:25.42 | *** join/#uphpu _carbohydrate (~textual@192.150.9.201) |