Your message dated Tue, 15 Jan 2019 19:08:54 +0200 with message-id <20190115170854.GC32397@localhost> and subject line Closing duplicate of #919320 has caused the Debian Bug report #919318, regarding nginx-extras: Would you please consider replacing Gzip module with Brotli for compression? to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 919318: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919318 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: nginx-extrasVersion: 1.14.2-2Severity: wishlistHello nginx maintainers, At the moment, nginx-extra package includes gzip module as one of the optional http modules. However it seems Gzip compression is vulnerable to BREACH [1] attack and the vulnerability researchers' recommendation is to disable Gzip compression. There are also discussions on stackexchange [2]. Instead of disabling compression over TLS/SSL completely, Google seems to be using a different compression scheme Brotli [3]. Would you consider replacing nginx Gzip module with Brotli? Thanks, Abi, --- [1] http://breachattack.com/#mitigations <http://breachattack.com/#mitigations> [2] https://security.stackexchange.com/questions/65625/current-state-of-breach-gzip-ssl-attack <https://security.stackexchange.com/questions/65625/current-state-of-breach-gzip-ssl-attack> [3] https://github.com/google/ngx_brotli <https://github.com/google/ngx_brotli>
--- End Message ---
--- Begin Message ---Seems this bug was submitted twice, and the follow-up discussion is in #919320. cu Adrian -- "Is there not promise of rain?" Ling Tan asked suddenly out of the darkness. There had been need of rain for many days. "Only a promise," Lao Er said. Pearl S. Buck - Dragon Seed
--- End Message ---
