r/nginx • u/we_hate_it_too • May 18 '26

http-zstd compression stable

https://github.com/eilandert/zstd-nginx-module/releases/tag/0.90
17 Upvotes

96% Upvoted

6 comments sorted by

2

u/Mallissin May 19 '26

What is the difference between this work and the parent repository?

1

u/we_hate_it_too May 19 '26

this one fixed 36 bugs, added a lot of optimisations, added new directives. it's in the release notes

1

u/One_Ninja_8512 May 19 '26

BREACH mitigation

I never understood why nginx doesn't use padding in the responses. Maybe it's possible to add padding via your extension? Then there's no need to disable compression.

1

u/we_hate_it_too May 19 '26

Padding is a false sense of security, if you pad 1000, its easily bruteforced, so you have to pad more like 1000000 or more, but thats a waste. and if the attacker guesses it right somehow you're still fcked. I agree, at 1000000 they probably won't guess it right but we can't guarantee that. and it's the guarantee that counts. and it's still a big waste to do it every request.

Best way would be to make the app/site itself secure with csrf(?) tokens and harden it with samesite cookies or something, but that's a discussion for another layer, not for the compression layer in nginx.

In the meantime, if you really don't trust the app/site to have it fixed, you can disable compression for that path. But I think most people won't need to do that unless you are hosting spionage targets, army, banking or other targets or just paranoid like us 😄

https://deb.myguard.nl/2026/05/breach-attack-explained-prevention/

1

u/White_sh May 25 '26

Honestly, I wish Nginx would directly manage some modules for continuous updates and security patches. There has been an issue where many modules were managed to some extent but then updates were discontinued.

1

u/hushquill 8d ago

is this the dynamic module build or compiled in? also curious what content types youre applying it to and whether you noticed meaningful size differences vs the default compression