Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99977
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain lerdorf.com designates 209.85.218.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <B9DD1E6D-2370-4407-A40B-1BB6F67FA72D@koalephant.com>
References: <CA+aNembkpeU+vTX0dr1r_NuPZkKu4Da2rMTbS3RWk2eSacF_KA@mail.gmail.com>
 <CAESVnVrCndhLSuxZzNp5xqQLp8SC0wGSDAq8cjH+fRew-cCf1g@mail.gmail.com>
 <CANUQDCjB9UY8jTmmp43bQAW_9xJnoMbREN1zOQh1LubTfO4C-w@mail.gmail.com>
 <CACXBjuiL_=-qy53BWbB31_t_XJXqBguwVToS9bV=2K2np+zaRA@mail.gmail.com> <B9DD1E6D-2370-4407-A40B-1BB6F67FA72D@koalephant.com>
Date: Thu, 20 Jul 2017 13:34:09 -0400
Message-ID: <CACXBjuh_mpQouPMSFra4t3p_3LaiDCtb6FTiBoq3AF9qONofQQ@mail.gmail.com>
To: Stephen Reay <php-lists@koalephant.com>
Cc: Niklas Keller <me@kelunik.com>, Sara Golemon <pollita@php.net>, 
	Mathias Grimm <mathiasgrimm@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a113b04686a9b8c0554c32a2f"
Subject: Re: [PHP-DEV] php.net website
From: rasmus@lerdorf.com (Rasmus Lerdorf)

--001a113b04686a9b8c0554c32a2f
Content-Type: text/plain; charset="UTF-8"

On Wed, Jul 19, 2017 at 11:59 PM, Stephen Reay <php-lists@koalephant.com>
wrote:
>
> Does it need to be geo-dns, or could it instead be "geo-http" - a small
> number of servers responding to (www.)?php.net, which then respond with
> http redirects based on client ip. This is similar to how Debians "new"
> mirror service works for apt repos.
>
>
> I know it would be very nice to have the URLs stay as php.net (no CCn.
> Prefix) but anything else simple is going to involve tls certs for the base
> domain on servers the project doesn't control.
>
> The only other option I can see, would be to use "keyless" tls. It's
> described pretty well by CF here: https://www.cloudflare.
> com/ssl/keyless-ssl/
>
> Unfortunately I don't know that cf have open sourced their nginx&openssl
> patches to make them talk to a remote key server.
>

I did look at the stuff from Cloudflare last year, but at the time they
hadn't opened enough of it to implement.

And it is really nice to have www.php.net be fast and low-latency from all
over the world. Even the initial request. We are quite spoiled in Europe
and North America with our fast peering. But in many other parts of the
world, even if the local connection is fast, getting to a server in
N.America is quite slow. but yes, eventually we may have to give up on
geo-dns if we can't find a decent way to layer https on top of it.

-Rasmus

--001a113b04686a9b8c0554c32a2f--