Quantcast
Viewing latest article 9
Browse Latest Browse All 11

Answer by Zypher for Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

I was going to post this as a comment, but ran out of space.

For @Kop and @Rook:

For a site the size of Stack Overflow/Server Fault/Super User as well as the Stack Exchange network, you CANNOT just slap a $20 certificate onto your web servers and call it a day. You would kill the performance of the websites as SSL processing is a network-overhead intensive operation. Even though it is not as CPU intensive as I once knew to be true, you still do need to account for CPU in your planning, and implementation - because it does add overhead and when you are dealing with 10MM Monthly uniques that can start adding up quick.

To do this properly we would need to implement a highly available SSL load balancer/proxy that could handle the inbound SSL connections and not choke. To handle the load of the Trilogy in Four parts alone that would probably require (and I'm guessing here because we haven't run the numbers for obvious reasons) at least 4-6 very beefy servers, at about 6-8k a piece, plus Kyle's and my time to design, implement and test the solution.

Running SSL on a large website is NOT a cheap $20 certificate, and you don't just go slapping SSL certs onto your web servers and call it a day. For the amount of traffic we receive it is a lot more expensive and involved to get SSL running properly without degrading the performance of the site.

EDIT: Just to clarify BUYING THE CERTIFICATE IS NOT THE ISSUE


Viewing latest article 9
Browse Latest Browse All 11

Trending Articles