WEBVTT

NOTE StreamSec Tools 4.1.2 - One port. Three protocols. No glue. Captions = the narration.

1
00:00:00.000 --> 00:00:06.300
StreamSec Tools 4.1.2. One port. Three protocols. No glue.

2
00:00:06.500 --> 00:00:18.830
For twenty-five years, StreamSec Tools has been the TLS inside someone else’s network stack — RealThinClient, Indy, Synapse, NexusDB, kbmMW.

3
00:00:19.040 --> 00:00:27.250
You can still do that. But with release 4.1.2, for the first time, the library carries the application layer itself.

4
00:00:27.460 --> 00:00:32.900
HTTPS. REST. And SNIF — its own secure remoting framework.

5
00:00:33.110 --> 00:00:46.850
It starts with the asynchronous TLS server component. Not a cleartext server with an SSL adapter bolted on — a TLS server first. Every connection speaks TLS from the first byte.

6
00:00:47.050 --> 00:01:04.270
The TLS handshake itself — through its protocol-negotiation extension, ALPN — decides which application protocol answers: HTTP/2, HTTP/1.1, or snip, the transport of SNIF remoting.

7
00:01:04.480 --> 00:01:12.740
The two HTTP plugin components dispatch into one shared router, and a REST server component mounts on top of it.

8
00:01:12.950 --> 00:01:25.520
Underneath: I/O completion ports on Windows, epoll on Linux, kqueue on macOS — with sharded TLS engines, so handshakes run in parallel across cores.

9
00:01:25.720 --> 00:01:33.910
Wiring it up is component work. Drop the TLS server component; identity, trust and policy belong there.

10
00:01:34.110 --> 00:01:39.620
Drop the two HTTP plugin components and share one router between them.

11
00:01:39.830 --> 00:01:50.520
Mount the REST server component on top — pointed at one protocol component, it serves HTTP/2 and HTTP/1.1 alike.

12
00:01:50.720 --> 00:01:57.570
Register a handler once. It answers identically whichever protocol the client negotiated.

13
00:01:57.780 --> 00:02:06.530
A REST route is an event: templated paths with captures, and authentication that is deny-by-default the moment you configure it.

14
00:02:06.730 --> 00:02:12.340
JSON in, JSON out. The handler reads the capture and sends its answer.

15
00:02:12.550 --> 00:02:22.710
Standard problem-detail JSON on errors, idempotency keys honoured out of the box, and the right authentication challenge on a 401.

16
00:02:22.920 --> 00:02:30.730
The defaults are hardened. Strict request framing on HTTP/1.1, against request smuggling.

17
00:02:30.930 --> 00:02:38.230
Guards for the published HTTP/2 abuse patterns: flood attacks, rapid reset, and header bombs.

18
00:02:38.440 --> 00:02:45.740
Every budget is published and tunable in the Object Inspector: per request, per connection, and per server.

19
00:02:45.940 --> 00:02:50.910
And with the ACME client component, certificates issue and renew themselves.

20
00:02:51.120 --> 00:03:06.990
Then there is SNIF: the Secure Network Interface Framework. A class on one side, an interface on the other, and Delphi’s run-time type information in between. No IDL, no WSDL, no generated proxies.

21
00:03:07.200 --> 00:03:13.730
Publish an ordinary Delphi class, mark it with the roles allowed to call it, and register it.

22
00:03:13.930 --> 00:03:22.890
On the client, declare the matching interface and ask the client component for an implementation. The call to Add runs on the server.

23
00:03:23.100 --> 00:03:33.410
New in 4.1.2, SNIF’s transport rides the same TLS server as your web traffic — one more protocol plugin, on the same port.

24
00:03:33.610 --> 00:03:50.890
The client component’s single start call does the whole bring-up: connect, TLS 1.3 handshake, open the channel, and log the user in with a password-authenticated key exchange — cryptographically bound to this very TLS connection.

25
00:03:51.100 --> 00:03:57.250
Lost password? A single recovery call runs the one-time-code flow end to end.

26
00:03:57.450 --> 00:04:04.810
Access is role-based and deny-by-default: a forgotten annotation denies — it never exposes.

27
00:04:05.010 --> 00:04:15.420
All of it is measured against peers we did not write: curl, OpenSSL, the Node.js HTTP/2 client, and everyday browsers.

28
00:04:15.620 --> 00:04:21.360
And it is the same stack that serves StreamSec’s own support forum and download site.

29
00:04:21.570 --> 00:04:33.900
Pure Object Pascal, compiled into your executable — Win32, Win64, Linux64. No DLLs, no bindings, no patch chase.

30
00:04:34.100 --> 00:04:41.800
StreamSec Tools 4.1.2.355. Available now at streamsec.com.