Re: [hybi] [Technical Errata Reported] RFC6455 (3215)

IMHO this is not really a valid erratum, although it's a worthy topic
for discussion if and when this working group (or a successor working
group) decides to work on a document that might supersede RFC 6455.

On 5/6/12 6:30 PM, RFC Errata System wrote:
> 
> The following errata report has been submitted for RFC6455,
> "The WebSocket Protocol".
> 
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata_search.php?rfc=6455&eid=3215
> 
> --------------------------------------
> Type: Technical
> Reported by: Jesse Katzman <jesse.katzman@gmail.com>
> 
> Section: 5.3
> 
> Original Text
> -------------
> The unpredictability of the masking key is essential to prevent authors of malicious applications from selecting the bytes that appear on the wire.
> 
> Corrected Text
> --------------
> 
> 
> Notes
> -----
> I don't see how the client-to-server masking prevents "authors of malicious applications from selecting the bytes that appear on the wire".
> 
> Maliciously changing the contents of a message simply requires a few more steps than it would without masking, as far as I can tell.
> 
> I'm quite new at networking, so perhaps I'm missing something.  Thank you.
> 
> Instructions:
> -------------
> This errata is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party (IESG)
> can log in to change the status and edit the report, if necessary. 
> 
> --------------------------------------
> RFC6455 (draft-ietf-hybi-thewebsocketprotocol-17)
> --------------------------------------
> Title               : The WebSocket Protocol
> Publication Date    : December 2011
> Author(s)           : I. Fette, A. Melnikov
> Category            : PROPOSED STANDARD
> Source              : BiDirectional or Server-Initiated HTTP
> Area                : Applications
> Stream              : IETF
> Verifying Party     : IESG
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi