hmmm.. depends on your authentication scheme. I am using a pretty tight security policy to control who/what can access my hb.
I will be adding SSL/TLS support to everything hb related real soon. Client side and server side. So you can expect that we will put that out for release within the next couple of weeks (hopefully!).
My back end for the hb and call back server is python.
WS are only available on the front end client in Chrome right now, but the client JS will control the connection (http long-poll vs. ws) so when they become more wide spread, it will figure it out itself.
There has been some chatter about nginx as a proxy, but I know nothing about that.
You can hit us up all day on the IRC @ #hookbox - if you need a quicker response.
Thanks,
Rob.