Re: [hybi] WebSocket, TLS and intermediaries

Willy Tarreau <w@1wt.eu> Wed, 21 July 2010 04:44 UTC

Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA2373A6B59 for <hybi@core3.amsl.com>; Tue, 20 Jul 2010 21:44:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.212
X-Spam-Level:
X-Spam-Status: No, score=-4.212 tagged_above=-999 required=5 tests=[AWL=-2.169, BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 89O--8RR7tqy for <hybi@core3.amsl.com>; Tue, 20 Jul 2010 21:44:52 -0700 (PDT)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id B509A3A69D7 for <hybi@ietf.org>; Tue, 20 Jul 2010 21:44:51 -0700 (PDT)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id o6L4iuYh029456; Wed, 21 Jul 2010 06:44:56 +0200
Date: Wed, 21 Jul 2010 06:44:56 +0200
From: Willy Tarreau <w@1wt.eu>
To: Mike Belshe <mike@belshe.com>
Message-ID: <20100721044456.GB26999@1wt.eu>
References: <h2w5c902b9e1004152345j992b815bz5f8d38f06a19181a@mail.gmail.com> <Pine.LNX.4.64.1004160701250.751@ps20323.dreamhostps.com> <4BC860FD.8080007@webtide.com> <Pine.LNX.4.64.1004161952530.751@ps20323.dreamhostps.com> <35EFEA5E-9017-48A1-BB66-A0AF947E159F@d2dx.com> <AANLkTinihlL2sn3Kiwtcl7QYKhFlvmj9lvmH4_z02xF7@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <AANLkTinihlL2sn3Kiwtcl7QYKhFlvmj9lvmH4_z02xF7@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] WebSocket, TLS and intermediaries
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 Jul 2010 04:44:53 -0000

On Tue, Jul 20, 2010 at 04:29:07PM -0700, Mike Belshe wrote:
> BTW - there is another data point here; deployment of WebSockets over port
> 80 was measured in Chrome to have ~67% success rate today.  Deployment over
> port 443 (with TLS) has a >95% success rate.  So, if you don't use TLS, then
> browsers and websites will need to be made more complex to deal with the
> edge case of WebSockets failing in weird ways due to existing intermediaries
> which fail, even after the WebSocket handshake.

I'm not surprized at all by this, the handshake it build so that most
cases which would transparently work by default will fail ! This is the
big failure of this protocol right now. We're trying to break compatibility
with 10 years of work towards interoperability between components that
try their best to be transparent to each other, and everything will have
to be reinvented from scratch.

Willy