Re: Fwd: New Version Notification for draft-nottingham-bikeshed-length-00.txt

Willy Tarreau <> Wed, 18 March 2020 04:08 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id B26293A1033 for <>; Tue, 17 Mar 2020 21:08:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.651
X-Spam-Status: No, score=-2.651 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ISaH5b2b9Bjr for <>; Tue, 17 Mar 2020 21:08:49 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id B932C3A1036 for <>; Tue, 17 Mar 2020 21:08:49 -0700 (PDT)
Received: from lists by with local (Exim 4.92) (envelope-from <>) id 1jEPxG-0008W8-7C for; Wed, 18 Mar 2020 04:05:18 +0000
Resent-Date: Wed, 18 Mar 2020 04:05:18 +0000
Resent-Message-Id: <>
Received: from ([]) by with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from <>) id 1jEPxE-0008VH-CV for; Wed, 18 Mar 2020 04:05:16 +0000
Received: from ([] by with esmtp (Exim 4.92) (envelope-from <>) id 1jEPxC-0003Xi-Cw for; Wed, 18 Mar 2020 04:05:16 +0000
Received: (from willy@localhost) by pcw.home.local (8.15.2/8.15.2/Submit) id 02I44vtV012336; Wed, 18 Mar 2020 05:04:57 +0100
Date: Wed, 18 Mar 2020 05:04:57 +0100
From: Willy Tarreau <>
To: Mark Nottingham <>
Cc: HTTP Working Group <>
Message-ID: <>
References: <> <>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <>
User-Agent: Mutt/1.6.1 (2016-04-27)
Received-SPF: pass client-ip=;;
X-W3C-Hub-Spam-Status: No, score=-4.9
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, W3C_AA=-1, W3C_IRA=-1, W3C_WL=-1
X-W3C-Scan-Sig: 1jEPxC-0003Xi-Cw 6ea1f327a05554a2b0431ec505099220
Subject: Re: Fwd: New Version Notification for draft-nottingham-bikeshed-length-00.txt
Archived-At: <>
X-Mailing-List: <> archive/latest/37454
Precedence: list
List-Id: <>
List-Help: <>
List-Post: <>
List-Unsubscribe: <>

Hi Mark,

On Wed, Mar 18, 2020 at 12:29:24PM +1100, Mark Nottingham wrote:
> FYI, as discussed in <>.
> Prettier version at <>.

Interesting. I've also thought many times "too bad we don't have a distinct
header field for this one". I too think that something advisory may be
very useful, but I'm also seeing some misuse. Typically some recipients
might decide to allocate a large enough memory area to receive the
advertised contents, and this will be used to DoS some servers by sending
very large lengths (as we used to see with C-L in the past).

Despite this I still think that if we word it appropriately (i.e. "do not
trust it") and if we make sure it is never correlated to the effective
length, we could easily address potential issues and make it useful.

I think that it could be worded as suggesting that even the sender does
not necessarily precisely know the exact value to place there. For example
if a client needs to decompress a file before sending it, it could
arbitrarily advertise 10 times its compressed size. Similarly a client
uploading a log file could advertise the current size plus a small
margin, knowing that the file might continue to grow during the transfer.

If presented like this it should be clear that the recipient must not trust
it for anything but a progress bar or 413 and that could be very useful.

BTW I wouldn't say "it is not allowed to occur in trailer sections" since
it's not expected to have any particular meaning there, and adding a new
rule will only make its processing more complicated, I'd simply say that
it's pointless to place it there and that it may be ignored.