Re: [hybi] Do we have a sense of when browsers will be supporting draft-ietf-hybi-thewebsocketprotocol-03 ?

[Greg Wilkins <[e-mail]>]

On 3 December 2010 09:18, Maciej Stachowiak <[e-mail]> wrote:
>
> On Dec 2, 2010, at 11:07 PM, Greg Wilkins wrote:
>
>>
>> The use of CONNECT instead of GET+Upgrade needs to be proposed as a
>> change in it own right and not mixed up with several other issues.  If
>> a CONNECT proposal can overcome the objections to it, then great!
>> But it is not the only option we have.
>
> You supported a CONNECT proposal yesterday:
>
> http://www.ietf.org/mail-archive/web/hybi/current/msg04860.html
> http://www.ietf.org/mail-archive/web/hybi/current/msg04861.html
>
> Do those messages reflect your current position?


Maciej,

I'm not opposed to a CONNECT solution and I'd like to see a clear
proposal made that separates out CONNECT from the other issues (bogus
hosts etc).  I'd like to see if such a proposal can be made acceptable
to the objections raised by Roy and others.   The proposals made
yesterday do look like a good way to progress.

But I don't think that CONNECT is universally accepted and I think the
case still has to be made to convince others.  I'm not totally
convinced myself, but think it is worth considering and asking for
concrete proposals without bogus header and encoding distractions is a
good step towards evaluating those concerns.

Most importantly  I do *not* think that CONNECT is our only available
solution.  My recent posts have been to simply correct some
overstatements about the vulnerability (or otherwise) of GET+Upgrade.
  I still think that  GET+Upgrade together with robust framing is a
viable solution - but I recognise that some have concerns with a
defence based only on framing.   Thus I'm happy to try form a
consensus around CONNECT, but at the same time I'm talking about
misconceptions of the framing defence because that applies regardless
of handshake and may be important if we can't overcome objections to
CONNECT.

Personally, my current favourite option now is for a dedicated WS port
and the use of CONNECT to access it via port 80 if it cannot be
reached directly.       But it looks like CONNECT has some serious
objections to its use and if they cannot be overcome, then I'm not
opposed to using GET+Upgrade.    IE I don't really care which
handshake we use so long as we can agree on one or the other.  I care
about HTTP compatibility, valid routing data and robust extensible
framing and I think these concerns.

cheers