Re: [hybi] WebSocket, TLS and intermediaries

[Greg Wilkins <[e-mail]>]

On 21 July 2010 10:15, Roberto Peon <[e-mail]> wrote:

>
> Schools and other institutions will block port 443 if they feel
> unacceptable content is flowing over it and they have other means of dealing
> with it.
> I believe that this means that we need an 'authorized proxy' model. No
> proxy would be fully transparent (unless it was a reverse proxy representing
> the real endpoint), however it should be exceptionally easy to install a
> policy allowing the proxy explicitly. It is a hair more annoying for the
> user than no proxy, but it gives schools, etc. a way to control the
> computers that they own without blocking port 443 for everyone and
> everything.
>

+1

As Mike has said, there are good motives and bad motives for intermediaries.
We have to find a way to allow the good motives to be supported, even if
that costs a bit of complexity in the handshake/protocol.

Having explicit intermediaries would be very useful for knowing  timeouts,
optimizing keepalives and security considerations.

cheers