Re: [hybi] Versioning is a anti-pattern

[Benjamin Black <[e-mail]>]

On Wed, 3 Sep 2010, Adam Barth wrote:
> Versioning has been a big pain point for TLS.  Here's a presentation
> that outlines some recent implementation experience:
>
> http://www.ietf.org/proceedings/65/slides/tls-6.pdf
>
> I encourage you to read through the presentation (it's pretty short).
>

Having dealt extensively with exactly this problem, I don't see an
"anti-pattern" in versioning.  To the contrary, properly specified and
implemented versioning is very effective in making protocols that are
interoperable and extensible (one or the other alone is much easier
and does not require versioning).  The anti-pattern, as evidenced in
TLS and documented in the presentation you reference, is in
_under-specifying_ the protocol and not producing a way to _validate
compliance_ such that you can produce implementations that are
compliant and incompatible.  See slide 7 of the presentation for a
specific example.

Consider BGP4: it is ostensibly versioned, but almost all change
effort goes into extensions.  In turn, incompatible implementations
blow up in exciting, globally destructive ways every few years.  Look
at the introduction of the capabilities negotiation mechanism (which,
admittedly, did not cause _unexpected_ problems) 10 years ago, or the
recent IOS bug tickled by researchers (at Duke?) for specific
examples.

>> HTTP is the primary "web protocol" and AFAIK, its versioning is usually not
>> considered a failure.
>
> The version number in HTTP hasn't been change in a very long time.  I
> suspect we'd encounter tremendous difficulty if we tried to change it
> today.

Without delving into the realm of attempting to prove a negative, I
suggest this argument is invalid.  The fact is the change from 1.0 to
1.1 with HTTP did not result in nearly the raft of incompatible but
compliant implementation problems that were seen with SSL and TLS.
Protocol versioning can absolutely be done properly.  The existence of
improper specifications and implementations does not damn versioning
in general.


Back to lurking,
b

ps - This sort of voluntary rejection of rigorous specification and
compliance is exactly what I dislike about the current Websockets
protocol upgrade handshake.  It's kind of HTTP, but not quite.
Hilarity ensues.