Re: [hybi] deflate-stream and masking

Although I agree with you that deflate-stream is a bad idea and 
recognize that the decision to include it was made before it had been 
determined that masking applies only to payload data (so deflate-stream 
has to be done on masked data), I think it might be difficult to get 
agreement to remove it as a known extension in the spec at this point.

But just because it is a known extension does not mean it needs to be 
implemented. My suggestion is that everyone that thinks it is a bad idea 
should remove deflate-stream from their implementations and add in 
deflate-frame. So long as deflate-frame is available I don't imagine 
there will be a groundswell of consumer desire for the far less useful 
deflate-stream.

On 19/06/2011 11:33 PM, Greg Wilkins wrote:
> As part of my continuing campaign against including deflate-stream in
> the specification as a standard extension, I did a quick test of how
> well it works when applied to masked frames.
>
> I took a days worth of traffic from an IRC channel and wrapped it up
> as JSON messages sent as websocket frames.
> There were 487 message that looked like:
>
>       {channel:"#webtide", username:"tbecker", text:"joakime: jenkins
> had issues pulling from github a couple of times  last week"}
>
> As an unmasked WS stream, it was 50675 bytes, and as a masked stream
> is was 52623 bytes.
> I then compressed both these streams with gzip and got 13306 bytes for
> unmasked and 51704 bytes for the masked!!!!
>
> So for this very typical example, masking was sufficiently random to
> completely negate the benefits of compression.
>
> So the deflate-stream "extension" is:
>
>   + next to useless for inbound traffic
>   + breaks all the rules of what an extension can do
>   + is potentially vulnerable to injection as attackers can send
> repeated patterns that may subvert masking
>   + can be replaced by the in-frame compression extension already proposed.
>   + was inserted in the draft with little or no discussion and without
> clear consensus.
>
> Can I call for a straw poll of who wants to keep this extension in the spec?
>
>
>
> regards
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi