Re: [ftpext] New Version Notification for draft-bryan-ftp-hash-05

[Iljitsch van Beijnum <[e-mail]>]

On 13 jul 2010, at 0:39, Anthony Bryan wrote:

> unless I'm misunderstanding, this would be MORE indirect, unoptimized,
> complex and DoSy than the current draft.

I'll grant you more indirect and more complex. But don't forget the first rule of client-server: let the client do the hard work.

> to be able to answer whether a hash is correct, the server still needs
> to know the correct hash?
> when you meet someone, do you ask "is your name Bob? no, how about
> Jim? no, Ed?" or do you just come right out and ask "what's your
> name?" which is simpler?

Ah, but the question isn't "what's your name" but something that requires a rather expensive operation, which is always a nice DoS vector. 

> you mention partial file hashes, some of those nonstandard commands
> like XCRC and XMD5 support it with a byte range.
> do you think HASH should support partial file hashing?

No, because that way the client could ask the server to do an almost infinite number of hashes on a single file, and it makes it impossible for the server to precompute the hashes.