Re: [hybi] Why not just use ssh?

[Willy Tarreau <[e-mail]>]

Hello Adam,

On Wed, Sep 01, 2010 at 01:48:58PM -0700, Adam Barth wrote:
> I claim that the TLS+NPN protocol that I sent to the list earlier
> resists cross-protocol attacks, which are a clear and plausible threat
> model.  The security argument is fairly straightforward.
> 
> As for complexity, the TLS-only model is less complex than the
> existing handshake, as evidenced by the fact that I would describe it
> completely simply by deleting text from the current draft.

If we want to be fair, we should say that the TLS-only model requires
a lot more additional capabilities on intermediates and servers, and
certificate management on the server. We're not comparing apples to
apples. Also, the current text is heavy because it tries to redefine
something as complex as HTTP without telling it is HTTP. So basically
you have 2616 in the draft. Having a paragraph stating that it relies
on "Upgrade: WebSocket" in requests and responses with a 101 in the
response (as 2817 explains it) would be a lot smaller and straightforward.

Also, I don't see why TLS could not be used on top of HTTP as is proposed
by 2817. This has the advantage of HTTP being easy to handle with existing
infrastructure and offers the better protection of TLS.

Just a few thoughts.

Willy