Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

[Bruce Atherton <[e-mail]>]

On 08/09/2011 5:35 PM, "Martin J. Dürst" wrote:
>
> However, just for the record, I would want to point out that the way 
> the browser maker people explained their strong desire for masking was 
> "if ever something bad happens, it's always the browser which is 
> blamed". That seems to indicate that the guys in charge of performing 
> masking from the client side (e.g. the browser makers) and the guys 
> interested in having it done are the same. In such a case, changing a 
> MUST to a SHOULD is much less of a problem than when the SHOULD is 
> there to protect somebody else's interest.

This is exactly right. Browser makers are the ones who insisted on this 
feature, and they will certainly implement it. I doubt that any other 
implementer of a client even wants masking.

I see no reason to require servers to reject connections with incoming 
unmasked frames. Masking is a concern for browser clients only.

The argument has been made that clients will be lazily implemented to 
not implement masking, but I can't understand why that is an issue. Such 
custom clients could send whatever they wanted to anyway. Browser 
clients will always have masking, unless it is shown that there is no 
benefit to it because the buggy intermediaries are gone.