Re: [hybi] Extensibility mechanisms?

Julian Reschke <julian.reschke@gmx.de> Mon, 19 April 2010 07:45 UTC

Return-Path: <julian.reschke@gmx.de>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 683FE3A6827 for <hybi@core3.amsl.com>; Mon, 19 Apr 2010 00:45:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.144
X-Spam-Level:
X-Spam-Status: No, score=-2.144 tagged_above=-999 required=5 tests=[AWL=-2.460, BAYES_50=0.001, SARE_MILLIONSOF=0.315]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5L1aYcD1fTas for <hybi@core3.amsl.com>; Mon, 19 Apr 2010 00:45:30 -0700 (PDT)
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20]) by core3.amsl.com (Postfix) with SMTP id 3A2A43A6801 for <hybi@ietf.org>; Mon, 19 Apr 2010 00:45:29 -0700 (PDT)
Received: (qmail invoked by alias); 19 Apr 2010 07:45:17 -0000
Received: from p508FF3F6.dip.t-dialin.net (EHLO [192.168.178.33]) [80.143.243.246] by mail.gmx.net (mp059) with SMTP; 19 Apr 2010 09:45:17 +0200
X-Authenticated: #1915285
X-Provags-ID: V01U2FsdGVkX18BSus/EM8BfrnQx+kVW2eVQuljWaF+NnzYCRogHI DuMFcg+nYD+tKA
Message-ID: <4BCC0A07.9030003@gmx.de>
Date: Mon, 19 Apr 2010 09:45:11 +0200
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.4) Gecko/20060516 Thunderbird/1.5.0.4 Mnenhy/0.7.4.666
MIME-Version: 1.0
To: Ian Hickson <ian@hixie.ch>
References: <h2w5c902b9e1004152345j992b815bz5f8d38f06a19181a@mail.gmail.com> <Pine.LNX.4.64.1004160701250.751@ps20323.dreamhostps.com> <4BC860FD.8080007@webtide.com> <Pine.LNX.4.64.1004161952530.751@ps20323.dreamhostps.com> <4BC96A0D.4080904@webtide.com> <Pine.LNX.4.64.1004180246380.751@ps20323.dreamhostps.com> <4BCAB2C1.2000404@webtide.com> <B9DC25B0-CD21-44E7-BD9B-06D0C9440933@apple.com> <4BCB7829.9010204@caucho.com> <Pine.LNX.4.64.1004182349240.751@ps20323.dreamhostps.com>
In-Reply-To: <Pine.LNX.4.64.1004182349240.751@ps20323.dreamhostps.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
X-FuHaFi: 0.62
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Extensibility mechanisms?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 19 Apr 2010 07:45:31 -0000

On 19.04.2010 02:05, Ian Hickson wrote:
> On Sun, 18 Apr 2010, Scott Ferguson wrote:
>>
>> The client and server APIs must be suitable for amateur programmers, and
>> the wire protocol must support those simple APIs, but it's _not_
>> important that the wire protocol be implementable by someone who can't
>> understand buffering, chunking or encoding. After all, HTTP/1.1 requires
>> those capabilities.
>
> IMHO, HTTP is a disaster in terms of getting multiple server-side

It seems we have a fundamental disagreement about what is a "disaster".

> implementations. Over three quarters of the market is dominated by two
> vendors, and the third largest vendor on a per-server basis is a company

Sounds like the browser market, btw.

> that runs a proprietary implementation and derives significant benefit
> from being able to do so. There are some custom servers, e.g. in some set

Where's the problem with that?

> top boxes or other network devices too small to run one of the few common
> servers, and many of those are highly incomplete or buggy implementations.

There are also many servers running, for instances, one of the many 
Servlet/J2EE implementations. These may not be significant compared to 
the absolute number of servers out there, but how is that relevant???

> I would not consider HTTP a model solution here. On the contrary. Its
> complexity has led to a rather stagnant monoculture which is an attacker's
> dream. A single exploit can affect millions of servers.
 > ...

Yes. What does that have to do with the protocol, btw?

Best regards, Julian