Initial strawman for the 1.8.1 release notes

It takes more than communicating via SSL to be vulnerable to this attack. This sentence betrays the next and creates a context of concern that in most cases is unwarranted.

Look for example at [cocoaspdy](https://github.com/twitter/CocoaSPDY) who discuss a similar attack called CRIME. Rather than get into the weeds, they place responsibility on the user to make their own determination of risk, (eventhough the author is a security expert)! If you replace disable header compression with disable SSLv3, you have a pretty close preamble.

```
CRIME attack

The CRIME attack is a plaintext injection technique that exploits the fact that information can be inferred from compressed content length to potentially reveal the contents of an encrypted stream. This is a serious issue for browsers, which are subject to hijacks that may allow an attacker to issue an arbitrary number of requests with known plaintext header content and observe the resulting effect on compression.

In the context of an application that doesn't issue arbitrary requests, this is less likely to be an issue. However, before you ship a project with header compression enabled, you should understand the details of this attack and whether your application could be vulnerable.
```