Re: [hybi] Masking only Payload/Extension Data

Count me in as +1 in favour of no masking.

My reasoning being:
1. An application layer using a Websocket API cannot affect the
headers, only payload.
2. The Websocket connection is an *established* TCP connection that
has already navigated any intermediaries and satisfied their
connection requirements.
3. If these intermediaries choose to examine the data being passed
through this established connection, then it is their problem if they
expose themselves.
4. This alleged intermediary vulnerability would be available via any
mal-formed stream, if the intermediary is doing content examination.
5. Masking does not prevent man-in-the-middle attacks as the masking
key is included with the frame.
6. Agents that open a bare TCP connection and emulate Websocket allow
the attacker to craft custom frames or handshakes.  They can of course
generate whatever end-result masking they need.

So, I conclude that masking does not protect against (a)
man-in-the-middle or (b) a malicious application layer, or (c) attack
application.    Further, since the initial HTTP Upgrade handshake
negotiates connection establishment via any intermediary (satisfies
proxies, etc.), we must feel free to transmit any data content without
worrying we would disturb any hops between endpoints.   That is
fundamental to the definition of transparent intermediary.

On Thu, Mar 10, 2011 at 1:18 PM, Bruce Atherton <bruce@callenish.com> wrote:
> Are we voting on this now? If so, add my +1 for the proposal not to mask the
> framing.
>
> On 10/03/2011 2:25 AM, Brian wrote:
>>
>> By my count, we have six voices in favor so far, including myself:
>> Andy Green
>> Ytaka Takeda
>> Greg Wilkins
>> Willy Tarreau
>> Joel Martin
>> Brian McKelvey
>>
>> One on record as not having a strong opinion one way or the other:
>> Ian Fette
>>
>> And one opposed:
>> Adam Barth
>>
>>
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>