Re: [hybi] WebSocket, TLS and intermediaries

[Willy Tarreau <[e-mail]>]

On Tue, Jul 20, 2010 at 05:11:16PM -0700, Roberto Peon wrote:
> On Tue, Jul 20, 2010 at 5:04 PM, John Tamplin <[e-mail]> wrote:
> 
> > On Tue, Jul 20, 2010 at 8:01 PM, Maciej Stachowiak <[e-mail]> wrote:
> >
> >> This point is very important. Building on top of TLS has huge practical
> >> benefits. I think this outweighs the desire to more easily build transparent
> >> intermediaries. Any mechanism that allows intermediaries without being
> >> authorized by either endpoint is by definition a security vulnerability in
> >> the protocol.
> >>
> >> I think the benefits of TLS also outweigh the "amateur server implementor"
> >> argument. I don't think we want to make it easy to implement a security
> >> hole.
> >>
> >
> > How would requiring TLS impact games over WebSocket, such as GWT Quake?
> >  Maybe one day we will have a connection-oriented datagram protocol for WS,
> > but until then we have to make do with running over TCP.  Adding encryption
> > overhead might render WS unusable for this purpose.
> >
> 
> I'd be pretty surprised if SSL added enough overhead that it made WS
> unsuitable for games. It is far, far, far, more likely that the fact that
> we're using TCP renders it useless for certain classes of games.

SSL adds a lot of overhead due to the block mode for protocols exchanging
a few bytes in each direction. Think about chats where each typed character
will be sent as a few tens of bytes. This costs in terms of network bandwidth,
CPU and perceived latency for the user. Compare SSH with telnet over slow
links.

Also, SSL will limit adoption because at many places it will simply not
be available. It's very common to white-list only a handful of SSL sites
in many enterprises, schools, etc...

Willy