Re: [hybi] Last Call: <draft-ietf-hybi-thewebsocketprotocol-10.txt> (The WebSocket protocol) to Proposed Standard

Hector <sant9442@gmail.com> Fri, 02 September 2011 09:50 UTC

Return-Path: <sant9442@gmail.com>
X-Original-To: hybi@ietfa.amsl.com
Delivered-To: hybi@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E33B21F8FB4; Fri, 2 Sep 2011 02:50:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.264
X-Spam-Level:
X-Spam-Status: No, score=-3.264 tagged_above=-999 required=5 tests=[AWL=0.336, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vkrjp0t-4p9K; Fri, 2 Sep 2011 02:50:48 -0700 (PDT)
Received: from mail-yw0-f44.google.com (mail-yw0-f44.google.com [209.85.213.44]) by ietfa.amsl.com (Postfix) with ESMTP id 43EEE21F8FB1; Fri, 2 Sep 2011 02:50:48 -0700 (PDT)
Received: by ywe9 with SMTP id 9so2531003ywe.31 for <multiple recipients>; Fri, 02 Sep 2011 02:52:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=kpYqfzSAM6HZgdKAQQxd5FN2NK0cYxDTH0HDUqOvQEs=; b=LHvErbUZ7jnlyN8GMz35SQiKdhB6w4n+OeXeaIPfy6C1MqZUdWGeCfibXEVl+Hq3sJ +XsqJGtgLSo/beU0YLxB2Xc6AHMiteidCO7nENk/SjzL54hXlTDCwnVrrYebA15Uy1Rw iaeddyi+n2a040koQ2VAb5ClDDKfkf1nFhh54=
Received: by 10.236.191.101 with SMTP id f65mr4385776yhn.61.1314957143526; Fri, 02 Sep 2011 02:52:23 -0700 (PDT)
Received: from adsl-215-50-126.mia.bellsouth.net (99-3-147-93.lightspeed.miamfl.sbcglobal.net [99.3.147.93]) by mx.google.com with ESMTPS id o23sm2037650yhk.3.2011.09.02.02.52.20 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 02 Sep 2011 02:52:21 -0700 (PDT)
Message-ID: <4E60A783.1090209@gmail.com>
Date: Fri, 02 Sep 2011 05:53:07 -0400
From: Hector <sant9442@gmail.com>
User-Agent: Thunderbird 2.0.0.24 (Windows/20100228)
MIME-Version: 1.0
To: "Roy T. Fielding" <fielding@gbiv.com>
References: <20110711140229.17432.23519.idtracker@ietfa.amsl.com> <5355F3EF-DD59-4D3C-9578-84043A3B8E90@gbiv.com>
In-Reply-To: <5355F3EF-DD59-4D3C-9578-84043A3B8E90@gbiv.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Mailman-Approved-At: Fri, 02 Sep 2011 03:01:58 -0700
Cc: Server-Initiated HTTP <hybi@ietf.org>, ietf@ietf.org, iesg@iesg.org
Subject: Re: [hybi] Last Call: <draft-ietf-hybi-thewebsocketprotocol-10.txt> (The WebSocket protocol) to Proposed Standard
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Sep 2011 09:50:49 -0000

Doesn't a WEBSOCKET client required a backend WEBSOCKET server to do 
handshaking and authentication to even allow it in the first so?  If 
so, whose network management constraint is it bypassing?

Roy T. Fielding wrote:
> I sent this originally in March, before the last call, but I see
> that it still applies for draft-ietf-hybi-thewebsocketprotocol-13.
> 
> If draft-ietf-hybi-thewebsocketprotocol-13 is approved, please
> add an IESG note to the effect of:
> =========
>    The WebSocket protocol is designed with an assumption that
>    TCP port 80 or 443 will be used for the sake of tunneling raw
>    socket exchanges over HTTP.  The result is a convoluted and
>    inefficient exchange of hashed data for the sake of bypassing
>    intermediaries that may be routing, authenticating, filtering,
>    or verifying traffic on those ports.  The sole reason for using
>    ports 80 and 443, and hence requiring the hashed data exchange,
>    is because many organizations use TCP port blocking at firewalls
>    to prevent unexpected network traffic, but allow the HTTP ports
>    to remain open because they are expected to be used for normal
>    Web request traffic.  WebSocket deliberately bypasses network
>    management constraints in order to enable Web application
>    developers to send arbitrary data though a trusted port.
> 
>    Naturally, the WebSocket protocol does not have the same network
>    characteristics as HTTP.  The messages exchanged are likely to
>    be smaller, more interactive, and delivered asynchronously over
>    a long-lived connection.  Unfortunately, those are the same
>    characteristics of typical denial-of-service attacks over HTTP.
>    Organizations deploying WebSockets should be aware that existing
>    network equipment or software monitoring on those ports may need
>    to be updated or replaced.
> =========
> 
> Cheers,
> 
> Roy T. Fielding                     <http://roy.gbiv.com/>
> 
> Begin forwarded message:
> 
>> From: "Roy T. Fielding" <fielding@gbiv.com>
>> Date: March 29, 2011 5:23:33 AM PDT
>> To: Server-Initiated HTTP <hybi@ietf.org>
>> Cc: iesg@iesg.org
>> Subject: reuse of port 80/443 in hybi
>>
>> I am finding it difficult to participate in hybi in any meaningful
>> way due to the very poor assumption that websockets traffic should
>> use the same ports as Web traffic.  Apparently, this "decision" was
>> made on the basis of hums at an in-person WG meeting and the chairs
>> believe it to be consensus (and thus quash any discussion that has
>> apparent consensus due to the extent to which people keep bringing
>> up old issues).  It might even make some sense, given the name of
>> this working group.
>>
>> Unfortunately, it is a fatal error.  The rest of the protocol
>> discussion is predicated on it, and enormously complex, for the
>> sole reason of that initial error in design.  More the pity.
>> It assumes that the network infrastructure that currently
>> monitors and balances traffic over 80/443 is going to instantly
>> adapt to TCP-over-HTTP, as opposed to treating it like a denial
>> of service attack.
>>
>> Browsers are fully capable of opening up new ports in firewalls
>> simply by concerted use of open standards.  Many other applications
>> do so without this painful corruption of existing protocols. Yes,
>> it takes time (but not as much time as one would think).  Yes,
>> there will be some companies that forcibly block some ports,
>> just like there are some companies that forcibly block HTTP
>> sites like facebook.com.  That is their right.  If the protocol
>> is safe to use, it will be deployable over time.  If not, then
>> it shouldn't make the Web situation worse by increasing the
>> amount of packet filtering at firewalls.
>>
>> So, I don't think the hybi work is worth continuing.  The rest of
>> the protocol decisions simply don't matter -- any of the already
>> deployed proprietary hacks are better by default because they
>> are no worse than hybi and don't have the imprimatur of the IETF.
>> I'd rather develop a protocol that works with network administration
>> rather than against it.
>>
>> I only ask that an IESG note be added to the final specification
>> to the effect that this protocol knowingly misuses the Internet
>> for the sake of bypassing organizational security.  Be honest and
>> let the admins make their own decisions.
>>
>>
>> Cheers,
>>
>> Roy T. Fielding                     <http://roy.gbiv.com/>
> 
> _______________________________________________
> Ietf mailing list
> Ietf@ietf.org
> https://www.ietf.org/mailman/listinfo/ietf