Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

I don't think we can go back on c->s masking. If someone really cares within
a datacenter, they are free to do nonstandard things within their own
infrastructure at their own risk, but I don't see why we would need to
mention that within a standard.

I don't see how a client would necessarily know that it's safe to disable
masking or not, and so I really don't think we should reopen that can of
worms.

As for S->C, I am ambivalent as to whether it's MAY or MUST NOT.

On Wed, Sep 7, 2011 at 5:14 AM, Richard L. Barnes <rbarnes@bbn.com> wrote:

> Sorry if I'm missing something (I missed the beginning of the thread), but
> are there people out there who actually *want* masking from the server to
> the client?  The work by abarth, ekr, et al. showed a roughly 40%
> performance hit due to masking under some circumstances -- presumably adding
> s2c masking would degrade performance even further.
>
> --Richard
>
>
> On Sep 7, 2011, at 3:38 AM, Len Holgate wrote:
>
> >>      If we allow the server to mask frames, clients need to
> >> implement logic for unmasking to prepare for them. As we
> >> don't know any important use-case of server-to-client
> >> masking, I think we should just forbid it.
> >>      OLD: All frames sent from the server to the client are
> >> not masked.
> >>      NEW: All frames sent from the server to the client MUST
> >> NOT be masked.
> >>
> >>      Let's also change
> >>      OLD: All frames sent from the client to the server are
> >> masked to avoid ...
> >>      NEW: All frames sent from the client to the server MUST
> >> be masked to avoid ...
> >
> > That sounds good; well better than it being vague anyway.
> >
> > Now, of course, the masking bit in the header is pretty much redundant...
> >
> > Equally good would be:
> >
> > OLD: All frames sent from the server to the client are not masked.
> > NEW: All frames sent from the server to the client CAN be masked but
> there's
> > no technical or security reason for them to be and so in most cases they
> > SHOULD NOT be masked.
> >
> > Clients already have the code to mask/unmask, the logic isnt that
> complex...
> >
> > Len
> > http://www.serverframework.com
> >
> > _______________________________________________
> > hybi mailing list
> > hybi@ietf.org
> > https://www.ietf.org/mailman/listinfo/hybi
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>