Re: [hybi] Anti-patterns (was Re: I-D Action:draft-ietf-hybi-thewebsocketprotocol-01.txt)

[Dave Cridland <[e-mail]>]

On Thu Sep  2 21:41:37 2010, Joe Hildebrand wrote:
> On 9/2/10 2:23 PM, "Shelby Moore" <[e-mail]> wrote:
> 
> > Specifically, imo the entire cross-protocol and same-origin  
> policy (SOP)
> > language needs to be stripped out of the draft. Imo, it is worse  
> than
> > useful.
> 
> This is a concrete technical suggestion.  Does anyone else agree  
> with it?
> 
> 
I think we do need to ensure that we can defend against  
cross-protocol attacks, and therefore that language (or something  
along those lines) needs to stay. It's a valid security concern, and  
we should offer mitigation for such attacks if desired.

I do note it may not always be desired; that is, it be actually be  
desirable to be able to offer websocket services which are accessible  
by hacky abuses of existing scripting interfaces in browsers.

For SOP, I think there is a case that it could be removed. There was,  
as I recall, a BOF at the last IETF concerning generalizing the SOP  
and other HTTP/Web security issues along these lines called HASMAT,  
and it seems to me that referring directly to that work might be a  
preferential option. Naturally, this depends on the progress of the  
HASMAT BOF, and I'm sadly ignorant of what's happening there.

I'd suggest that we as a group ask advice from our Area Director on  
the matter.

That said, it is currently informative text, as I understand it.

Dave.
-- 
Dave Cridland - mailto:[e-mail] - xmpp:[e-mail]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade