Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

[Willy Tarreau <[e-mail]>]

Hi Gabriel,

On Thu, Sep 08, 2011 at 09:33:43PM +0000, Gabriel Montenegro wrote:
> > > "
> > > OLD: All frames sent from the server to the client are not masked.
> > > NEW: All frames sent from the server to the client MUST NOT be masked.
> > >
> > > Let's also change
> > > OLD: All frames sent from the client to the server are masked to avoid ...
> > > NEW: All frames sent from the client to the server MUST be masked to avoid
> > ...
> > > "
> > 
> > As I indicated in another mail a few days ago, using this passive form always
> > causes trouble : when you receive something which is not supposed to be
> > possible, what should you do ? And if you're already able to process it anyway,
> > should you do it ?
> 
> The WG already decided to be very strict about this:
> http://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-14#section-10.7
> 
> If you find a protocol violation, there's no point in continuing with that peer. Less variability leads to less attack vectors, but also less code to test and maintain.
> 
> This is why I still think Takeshi-san's proposal above is the best outcome.

Well, I still disagree, but it's not important, so I won't insist ;-)

Cheers,
Willy