Resent-Date: Wed, 11 Feb 2015 04:16:15 +0000
Resent-Message-Id: <E1YLOil-0004CZ-FR@frink.w3.org>
MIME-Version: 1.0
In-Reply-To: <54DABF12.70609@treenet.co.nz>
References: <CAH_y2NE5Sa625XEec5WXJ7LdjK+h1b4M=Fc-_iGj2ZQKa1q_jg@mail.gmail.com>
 <5C91DE2C-BC82-4142-B292-815EED3627EC@mnot.net>
 <54DAA3A4.8060608@treenet.co.nz>
 <CAH_y2NG0_Y9nnDjLd2Fc_5wBessfy0DOfKBfkH8NiKjyzAiRVg@mail.gmail.com>
 <54DABF12.70609@treenet.co.nz>
Date: Wed, 11 Feb 2015 15:15:38 +1100
Message-ID: <CAH_y2NG5DtZ3zBP7FsUy392i8pcaHvTWvOdHODSi2gZ9vEZ_7g@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: Amos Jeffries <squid3@treenet.co.nz>
Cc: HTTP Working Group <ietf-http-wg@w3.org>
Content-Type: multipart/alternative; boundary=001a1132f49a795b74050ec841c6
Received-SPF: permerror client-ip=209.85.217.180;
 envelope-from=gregw@intalio.com; helo=mail-lb0-f180.google.com
Subject: Re: Invalid HTTP2 preface handling?
Archived-At: <http://www.w3.org/mid/CAH_y2NG5DtZ3zBP7FsUy392i8pcaHvTWvOdHODSi2gZ9vEZ_7g@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

--001a1132f49a795b74050ec841c6
Content-Type: text/plain; charset=UTF-8

On 11 February 2015 at 13:31, Amos Jeffries <squid3@treenet.co.nz> wrote:

>
> I agree with Mark completely about the 2.0 -> 1.1 transition being
> dangerous. 1.1 has a scary amount of legacy tolerances and gaps where
> nastiness can squeeze through.
>

I'm not really sure I see the difference between a 1.1 port being able to
opportunistically upgrade to 2.0 if it see a preface vs a 2.0 port doing a
downgrade if it sees as non-preface.    Both look the same to clients
regardless if they speak HTTP/1 or HTTP/2

Anyway, I've got my answer.  There is no specific threat, just a preference
to not allow such a simple upgrade/downgrade for the sake of prudence.    I
can accept that and while I'm still considering supporting a preface based
version switch, it will be a use-at-own-risk private feature.

cheers


-- 
Greg Wilkins <gregw@intalio.com>  @  Webtide - *an Intalio subsidiary*
http://eclipse.org/jetty HTTP, SPDY, Websocket server and client that scales
http://www.webtide.com  advice and support for jetty and cometd.

--001a1132f49a795b74050ec841c6
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">On 11 February 2015 at 13:31, Amos Jeffries <span dir=3D"ltr">&lt;<a hr=
ef=3D"mailto:squid3@treenet.co.nz" target=3D"_blank">squid3@treenet.co.nz</=
a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0=
 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=3D""><br=
>
</span>I agree with Mark completely about the 2.0 -&gt; 1.1 transition bein=
g<br>
dangerous. 1.1 has a scary amount of legacy tolerances and gaps where<br>
nastiness can squeeze through.<br></blockquote><div><br></div><div>I&#39;m =
not really sure I see the difference between a 1.1 port being able to oppor=
tunistically upgrade to 2.0 if it see a preface vs a 2.0 port doing a downg=
rade if it sees as non-preface.=C2=A0=C2=A0=C2=A0 Both look the same to cli=
ents regardless if they speak HTTP/1 or HTTP/2<br></div><div><br></div><div=
>Anyway, I&#39;ve got my answer.=C2=A0 There is no specific threat, just a =
preference to not allow such a simple upgrade/downgrade for the sake of pru=
dence.=C2=A0=C2=A0=C2=A0 I can accept that and while I&#39;m still consider=
ing supporting a preface based version switch, it will be a use-at-own-risk=
 private feature.<br><br>cheers<br></div></div><br clear=3D"all"><br>-- <br=
><div class=3D"gmail_signature"><div dir=3D"ltr">Greg Wilkins &lt;<a href=
=3D"mailto:gregw@intalio.com" target=3D"_blank">gregw@intalio.com</a>&gt;=
=C2=A0 @=C2=A0 Webtide - <i>an Intalio subsidiary</i><br><a href=3D"http://=
eclipse.org/jetty" target=3D"_blank">http://eclipse.org/jetty</a> HTTP, SPD=
Y, Websocket server and client that scales<br><a href=3D"http://www.webtide=
.com" target=3D"_blank">http://www.webtide.com</a>=C2=A0 advice and support=
 for jetty and cometd.<span style=3D"font-family:arial,sans-serif;font-size=
:13px"></span></div></div>
</div></div>

--001a1132f49a795b74050ec841c6--