IETF Logo Mail Archive

Re: [hybi] Extensibility mechanisms?

Scott Ferguson <ferg@caucho.com> Thu, 22 July 2010 20:50 UTC

Return-Path: <ferg@caucho.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B5E6E3A685F for <hybi@core3.amsl.com>; Thu, 22 Jul 2010 13:50:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.524
X-Spam-Level:
X-Spam-Status: No, score=-2.524 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YbS0vtY2dSJp for <hybi@core3.amsl.com>; Thu, 22 Jul 2010 13:50:33 -0700 (PDT)
Received: from smtp112.biz.mail.mud.yahoo.com (smtp112.biz.mail.mud.yahoo.com [209.191.68.77]) by core3.amsl.com (Postfix) with SMTP id F3AE83A680D for <hybi@ietf.org>; Thu, 22 Jul 2010 13:50:32 -0700 (PDT)
Received: (qmail 32590 invoked from network); 22 Jul 2010 20:50:50 -0000
Received: from [192.168.1.11] (ferg@66.92.8.203 with plain) by smtp112.biz.mail.mud.yahoo.com with SMTP; 22 Jul 2010 13:50:50 -0700 PDT
X-Yahoo-SMTP: L1_TBRiswBB5.MuzAo8Yf89wczFo0A2C
X-YMail-OSG: FOT9Pq0VM1lW8a5B1450lw_npwzzUq5hYZSf5j3.yBZiipF 4f6vtDAuvIeO2zC9Aoa6kBcx2h9.Olqr4T1qIEjAA8FvRQlz2bcS_jmhtT3c 2tcWx0by7WrR8U3o71cHfNJb896pUaebz54BhobNXQVhoKkn9cnUmY7uTqom cFsqS9eO_DA74GrVBOk6gCvfq9yp29UzO7AX4K0P6XGvPjv._JNKFDA_8iNJ O49COGsTFL4jNdYFsR9_RIYqYfwtI8ZvqZxV_BDjm4KQl6UOAuC.mRNhyODg fTNwKYXYDll.UNh9UNafy
X-Yahoo-Newman-Property: ymail-3
Message-ID: <4C48AF24.2040501@caucho.com>
Date: Thu, 22 Jul 2010 13:50:44 -0700
From: Scott Ferguson <ferg@caucho.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20100411)
MIME-Version: 1.0
To: Adam Barth <ietf@adambarth.com>
References: <h2w5c902b9e1004152345j992b815bz5f8d38f06a19181a@mail.gmail.com> <4BCC0A07.9030003@gmx.de> <Pine.LNX.4.64.1004190753510.23507@ps20323.dreamhostps.com> <4BCC111C.90707@gmx.de> <Pine.LNX.4.64.1004190837570.23507@ps20323.dreamhostps.com> <4BCC204D.30004@gmx.de> <z2gad99d8ce1004190822ne4dd36b6v54d63efcc448e840@mail.gmail.com> <Pine.LNX.4.64.1007202204270.7242@ps20323.dreamhostps.com> <AANLkTikkfdlUxQ0MGNvVQKa5gfovkGHWdCgyN9juKSQJ@mail.gmail.com> <4C462F9E.9030207@caucho.com> <Pine.LNX.4.64.1007212153110.7242@ps20323.dreamhostps.com> <AANLkTiku76oSucTNDFdwgsFBNFa_cCpC-YktTnMfX47-@mail.gmail.com> <4C479130.4020500@caucho.com> <AANLkTikLDjBP-Xs5t6TxmJuq4nG8jwThQ=n34B4cEmup@mail.gmail.com> <4C479CE4.6070805@caucho.com> <AANLkTims1er0Rbv0ysP4gRs1Kd0He8hapHeJ3nON=JQa@mail.gmail.com> <4C47C5B0.3030006@caucho.com> <AANLkTi=ND-FOH8OoD=TCbiyeSZ-h0LhxQBXN5w-2hfvj@mail.gmail.com> <4C48A468.3040009@caucho.com> <AANLkTikeLr325F03bowJu7NeHEqY_+OzEnQcrxHbCwhW@mail.gmail.co m>
In-Reply-To: <AANLkTikeLr325F03bowJu7NeHEqY_+OzEnQcrxHbCwhW@mail.gmail.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Extensibility mechanisms?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 22 Jul 2010 20:50:35 -0000

Adam Barth wrote:
> We need to know the server understands web sockets before spamming
> them with attacker-controlled bytes.  If we don't, we'll repeat the
> long and tragic history of cross-protocol vulnerabilities caused by
> HTTP POST.
>
> This is a hard requirement.
>   
Then I think it should be added to the requirements document, because 
that's a fundamental design decision.

-- Scott

v2.23.0 | Report a Bug | By Email