[HASMAT] fyi: WebSocket and HASMAT

=JeffH <Jeff.Hodges@KingsMountain.com> Fri, 25 June 2010 17:28 UTC

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kingsmountain.com; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:Content-Type:Content-Transfer-Encoding:X-Identified-User; b=AA5E/Mid8HxBfWrf8mhkTKH9ej5br6EQXePtUNQkmVtdVO0JiHZAKgWf++Fr/Du2ewYpwpCftj7nHqsmGVQutmhnVB1LyHdmUyxbGBnvomzfGZoKkDqfIjeeJkTtu4bJ;
Message-ID: <4C24E748.3020009@KingsMountain.com>
Date: Fri, 25 Jun 2010 10:28:40 -0700
From: =JeffH <Jeff.Hodges@KingsMountain.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20100411)
MIME-Version: 1.0
To: IETF HASMAT list <hasmat@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: [HASMAT] fyi: WebSocket and HASMAT
Precedence: list

fyi, one of the co-chairs of HyBi (aka websockets (hybi == hypertext 
bidirectional (protocol))) WG points out intersections between HyBi and HASMAT..

Subject: [hybi] WebSocket and HASMAT (was>:IETF BoF @IETF-78 Maastricht:
  HASMAT - HTTP Application Security Minus Authentication and Transport)
From: Salvatore Loreto <salvatore.loreto@ericsson.com>
Date: Thu, 10 Jun 2010 10:04:50 +0300
To: hybi@ietf.org


Hi there,

the HASMAT BoF is really important for HyBi, and I encourage all the
people interested and involved
in the WebSocket protocol design to participate to the BoF and become
involved in the HASMAT mailing list discussion

among the other stuff:

- HASMAT is related to Issue 3 we have currently in the Issues tracker:
http://trac.tools.ietf.org/wg/hybi/trac/ticket/3

- and it is also related to the security requirement we have in the
requirement draft:
http://tools.ietf.org/html/draft-ietf-hybi-websocket-requirements-00#section-3.4
and in particular to the following one

     REQ. 19:  WebSocket should be designed to be robust against cross-
        protocol attacks.  The protocol design should consider and
        mitigate the risk presented by WebSocket clients to existing
        servers (including HTTP servers).  It should also consider and
        mitigate the risk to WebSocket servers presented by clients for
        other protocols (including HTTP).


cheers
/Sal

[HASMAT] fyi: WebSocket and HASMAT =JeffH