Open legoktm opened 5 months ago
If we revisit the compression choice, see also some of the usability considerations in our current confusing mix of ZIP and gzip: #2289
Ahhh, right. I should clarify that I was just thinking about brotli for HTTP-level compression.
In the Firefox 126 release notes:
Firefox now supports Content-encoding: zstd (zstandard compression). This is an alternative to broti and gzip compression for web content, and can provide higher compression levels for the same CPU used, or conversely lower server CPU use to get the same compression. This is heavily used on sites such as Facebook.
Not sure when this will make its way to Tor Browser and if we can enable it in focal's apache.
Description
brotli is a (relatively) newer compression algorithm originally developed by Google that broadly provides better compression than gzip.
How will this impact SecureDrop users?
Better compression will lead to faster downloads, which even at say 10% improvement, could be a nice optimization given the slowness/flakiness of Tor.
How would this affect SecureDrop's threat model?
It's possible there are attacks against brotli that don't apply to gzip, but we rely on Tor for network level protection, so those attacks shouldn't apply to us, unless Tor itself is also vulnerable (and then out of our scope, IMO).
Technical notes
a2enmod brotli
, there's some other config snippet that needs to be added: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972632Accept-Encoding: gzip, deflate, br
header, where br is brotli