                                                                                                                                                                                                                                                                
Received-SPF: pass (google.com: domain of willc...@google.com designates 209.85.216.170 as permitted sender) client-ip=209.85.216.170;
MIME-Version: 1.0
Sender: willc...@google.com
In-Reply-To: <CAOdDvNrzTG4-afj6znv=qgeszFrxD1XNQYMxaFA082yJh6z...@mail.gmail.com>
References: <769472f7-e152-47db-b867-675f9e532e08@googlegroups.com>
	<CAOdDvNrzTG4-afj6znv=qgeszFrxD1XNQYMxaFA082yJh6z...@mail.gmail.com>
Date: Wed, 31 Oct 2012 12:28:17 -0700
Message-ID: <CAA4WUYj+3md29SF_C7Z8D0nWbJUPJR0_gz9pm99m=StmSFx...@mail.gmail.com>
Subject: Re: [spdy-dev] HAProxy supports NPN, which makes for an awesome SPDY deployment
From: =?UTF-8?B?V2lsbGlhbSBDaGFuICjpmYjmmbrmmIwp?= <willc...@chromium.org>
To: "spdy-dev@googlegroups.com" <spdy-dev@googlegroups.com>
Content-Type: multipart/alternative; boundary=047d7b5dbd9495d51804cd5fe71a

--047d7b5dbd9495d51804cd5fe71a
Content-Type: text/plain; charset=ISO-8859-1

I don't believe that's true, or Facebook is doing it wrong, or I'm
misremembering the False Start heuristic, but IIRC, False Start will not
trigger in Chromium unless you advertise NPN *and* a forward secure cipher
suite. I think they're just experimenting with their SPDY support.


On Wed, Oct 31, 2012 at 11:34 AM, Patrick McManus <mcma...@ducksong.com>wrote:

> nice.
>
> also, now that google has made npn the defacto signal for false start,
> this can give false start bonuses to folks not even running spdy but using
> haproxy. It appears that is what facebook is doing right now (not spdy
> ready yet, but they're running npn).
>
>
>
> On Wed, Oct 31, 2012 at 2:31 PM, Ilya Grigorik <igrigo...@gmail.com>wrote:
>
>> Specifically, all of the NPN negotiation can be done at HAProxy, and the
>> raw SPDY frames flow directly to the SPDY servers.
>>
>> Full config, with examples on how to route HTTP, HTTPS, and SPDY from the
>> same proxy instance:
>>
>> http://www.igvita.com/2012/10/31/simple-spdy-and-npn-negotiation-with-haproxy/
>>
>> I didn't cover this in the post, but you can also combine the above with
>> SNI rules, client key verification, and tons of other awesome.
>>
>> ig
>>
>
>

--047d7b5dbd9495d51804cd5fe71a
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

I don&#39;t believe that&#39;s true, or Facebook is doing it wrong, or I=
9;m misremembering the False Start heuristic, but IIRC, False Start will no=
t trigger in Chromium unless you advertise NPN *and* a forward=A0<span styl=
e=3D"font-family:arial,sans-serif;font-size:13px">secure cipher suite. I th=
ink they&#39;re just experimenting with their SPDY support.</span><br>
<div class=3D"gmail_extra"><br><br><div class=3D"gmail_quote">On Wed, Oct 3=
1, 2012 at 11:34 AM, Patrick McManus <span dir=3D"ltr">&lt;<a href=3D"mailt=
o:mcma...@ducksong.com" target=3D"_blank">mcma...@ducksong.com</a>&gt;</spa=
n> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">nice.<br><br>also, now that google has made =
npn the defacto signal for false start, this can give false start bonuses t=
o folks not even running spdy but using haproxy. It appears that is what fa=
cebook is doing right now (not spdy ready yet, but they&#39;re running npn)=
.<div class=3D"HOEnZb">
<div class=3D"h5"><br>
<div class=3D"gmail_extra"><br><br><div class=3D"gmail_quote">On Wed, Oct 3=
1, 2012 at 2:31 PM, Ilya Grigorik <span dir=3D"ltr">&lt;<a href=3D"mailto:i=
grigo...@gmail.com" target=3D"_blank">igrigo...@gmail.com</a>&gt;</span> wr=
ote:<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">Specifically, all of the NPN negotiation can=
 be done at HAProxy, and the raw SPDY frames flow directly to the SPDY serv=
ers.<div>

<br></div><div>Full config, with examples on how to route HTTP, HTTPS, and =
SPDY from the same proxy instance:</div><div><a href=3D"http://www.igvita.c=
om/2012/10/31/simple-spdy-and-npn-negotiation-with-haproxy/" target=3D"_bla=
nk">http://www.igvita.com/2012/10/31/simple-spdy-and-npn-negotiation-with-h=
aproxy/</a><br>

</div><div><br></div><div>I didn&#39;t cover this in the post, but you can =
also combine the above with SNI rules, client key verification, and tons of=
 other awesome.</div><span><font color=3D"#888888"><div><br>
</div><div>ig</div></font></span></blockquote></div><br></div>
</div></div></blockquote></div><br></div>

--047d7b5dbd9495d51804cd5fe71a--