[users] Recommended practice for mitigating BREACH/CRIME attacks with Apache 2.4+, SSL/TLS-only sites, and use of mod_deflate?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I have several SSL/TLS-only virtual sites running under Apache 2.4.7.
I haven't turned on compression because of all the warnings about
CRIME and BREACH.  However, when I run my sites against web site
analyzers they always suggest turning on compression.

So what is the consensus?

If compression is recommended, does the server cache the compressed
files served so that compression is not needed every time?  Is there
any advantage (assuming it is possible) in compressing the static
files served?

Thanks.

Best regards,

-Tom

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx





[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux