Re: [hybi] WebSocket, TLS and intermediaries

["Thomson, Martin" <[e-mail]>]

Greg Wilkins on 21 July 2010 10:36 AM:
> On 21 July 2010 10:15, Roberto Peon <[e-mail]> wrote:

> > Schools and other institutions will block port 443 if they feel unacceptable content is flowing over it and they have other means of dealing with it.
> > I believe that this means that we need an 'authorized proxy' model. No proxy would be fully transparent (unless it was a reverse proxy representing the real endpoint), however it should be exceptionally easy to install a policy allowing the proxy explicitly. It is a hair more annoying for the user than no proxy, but it gives schools, etc. a way to control the computers that they own without blocking port 443 for everyone and everything.
>
> +1
>
> As Mike has said, there are good motives and bad motives for intermediaries. We have to find a way to allow the good motives to be supported, even if that costs a bit of complexity in the handshake/protocol.
>
> Having explicit intermediaries would be very useful for knowing  timeouts, optimizing keepalives and security considerations.

+1

Despite the fact that a policy-enforcing proxy often causes a lot of grief, the alternative is worse.  We don't need another arms race.  Recognizing that people will enact policy, and providing ways that clients can cooperate, is more constructive than trying to circumvent policy measures.

--Martin