Netflix's house of cards to be fortified with HTTPS appliance
Crypto overheads could have cost video attic 'hundreds of millions' of dollars
Netflix will this year roll out HTTPS to keep customer's viewing habits secret.
The streaming company's April earnings letter (PDF) says it will make the move because it "helps protect member privacy, particularly when the network is insecure, such as public wifi, and it helps protect members from eavesdropping by their ISP or employer, who may want to record our members’ viewing for other reasons."
Netflix regularly opens the kimono to reveal its engineering efforts – and explained just how it will do HTTPS in a World Wide Consortium mailing list post by director of streaming standards Mark Watson.
Watson says the significant challenge to erase bandwidth overheads is worth the privacy benefits.
"[In October] we were uncertain of the gains we could achieve with software and hardware optimisation and of the timescale for those … I'm pleased to report we have made good progress on that," Watson says.
"We now believe we can deploy HTTPS at a cost that, whilst significant, is well justified by the privacy returns for our users."
Watson says the TLS deployment for its network of OpenConnect Appliances will apply to the Netflix site and content starting with large desktop browser tests, but did not stipulate the potential impact. Here's how the company plans to get the job done:
The Netflix OpenConnect Appliance is a server-class computer based on an Intel 64bit Xeon CPU and running FreeBSD 10.1 and Nginx 1.5. Each server is designed to hold between 10TB and 120TB of multimedia objects, and can accommodate anywhere from 10,000 to 40,000 simultaneous long-lived TCP sessions with customer client systems. The servers are also designed to deliver between 10Gbps and 40Gbps of continuous bandwidth utilisation. Communication with the client is over the HTTP protocol, making the system essentially into a large static-content web server.
Netflix has battled with the overheads HTTPS incurs; Watson estimated a capacity hit between 30 to 53 percent thanks to encryption computational overheads and a lack of optimisations to avoid data copies to and from user space.
Such a hit would cost Netflix potentially hundreds of millions of dollars a year.
Tweaks could cut that overhead by a third while speculative advancements in the next several years could crush it by up to 80 percent.
Watson has together with colleague Scott Long and consultant John-Mark Gurney published technical findings in a paper Optimising TLS for High–Bandwidth Applications in FreeBSD (pdf) which examines the "server-side performance implications on CPU computational and data-movement overhead when enabling TLS on Netflix’s OpenConnect Appliance network". ®