Re: [hybi] Why not just use ssh?

[Willy Tarreau <[e-mail]>]

On Wed, Sep 01, 2010 at 02:40:23PM -0700, Eric Rescorla wrote:
> On Wed, Sep 1, 2010 at 2:28 PM, Adam Barth <[e-mail]> wrote:
> 
> > On Wed, Sep 1, 2010 at 2:19 PM, Willy Tarreau <[e-mail]> wrote:
> > > Also, I don't see why TLS could not be used on top of HTTP as is proposed
> > > by 2817. This has the advantage of HTTP being easy to handle with
> > existing
> > > infrastructure and offers the better protection of TLS.
> >
> > RFC 2817 is a joke and, as I understand things, about to be moved to
> > historic.
> 
> 
> I don't know about historic or not, but the Upgrade part of HTTP is
> basically irrelevant
> to the Web. Everyone uses 2818. The CONNECT part is still relevant.

Well, FWIW, in january I suggested to use CONNECT instead of Upgrade
(because CONNECT is more common) but there were objections due to the
fact that CONNECT is only used with proxies right now, and it would
*possibly* be dangerous to send that to servers that can sometimes act
as proxies. In fact in my opinion, CONNECT is exactly equivalent to
an Upgrade, in that it establishes a bidirectionnal connection between
the client and the other side, and nothing prevents the "other side"
from being the server itself. Still that would not change anything
WRT the cross-protocol attacks. It could even be worse, because while
upgrade-aware servers are the only one which can respond 101, any
stupid server which does not check the method might respond 200 to
a CONNECT.

Willy