Re: [hybi] Last Call: <draft-ietf-hybi-thewebsocketprotocol-10.txt> (The WebSocket protocol) to Proposed Standard

Hector <> Fri, 02 September 2011 09:50 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 5E33B21F8FB4; Fri, 2 Sep 2011 02:50:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.264
X-Spam-Status: No, score=-3.264 tagged_above=-999 required=5 tests=[AWL=0.336, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id vkrjp0t-4p9K; Fri, 2 Sep 2011 02:50:48 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 43EEE21F8FB1; Fri, 2 Sep 2011 02:50:48 -0700 (PDT)
Received: by ywe9 with SMTP id 9so2531003ywe.31 for <multiple recipients>; Fri, 02 Sep 2011 02:52:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=kpYqfzSAM6HZgdKAQQxd5FN2NK0cYxDTH0HDUqOvQEs=; b=LHvErbUZ7jnlyN8GMz35SQiKdhB6w4n+OeXeaIPfy6C1MqZUdWGeCfibXEVl+Hq3sJ +XsqJGtgLSo/beU0YLxB2Xc6AHMiteidCO7nENk/SjzL54hXlTDCwnVrrYebA15Uy1Rw iaeddyi+n2a040koQ2VAb5ClDDKfkf1nFhh54=
Received: by with SMTP id f65mr4385776yhn.61.1314957143526; Fri, 02 Sep 2011 02:52:23 -0700 (PDT)
Received: from ( []) by with ESMTPS id o23sm2037650yhk.3.2011. (version=TLSv1/SSLv3 cipher=OTHER); Fri, 02 Sep 2011 02:52:21 -0700 (PDT)
Message-ID: <>
Date: Fri, 02 Sep 2011 05:53:07 -0400
From: Hector <>
User-Agent: Thunderbird (Windows/20100228)
MIME-Version: 1.0
To: "Roy T. Fielding" <>
References: <> <>
In-Reply-To: <>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Mailman-Approved-At: Fri, 02 Sep 2011 03:01:58 -0700
Cc: Server-Initiated HTTP <>,,
Subject: Re: [hybi] Last Call: <draft-ietf-hybi-thewebsocketprotocol-10.txt> (The WebSocket protocol) to Proposed Standard
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Server-Initiated HTTP <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 02 Sep 2011 09:50:49 -0000

Doesn't a WEBSOCKET client required a backend WEBSOCKET server to do 
handshaking and authentication to even allow it in the first so?  If 
so, whose network management constraint is it bypassing?

Roy T. Fielding wrote:
> I sent this originally in March, before the last call, but I see
> that it still applies for draft-ietf-hybi-thewebsocketprotocol-13.
> If draft-ietf-hybi-thewebsocketprotocol-13 is approved, please
> add an IESG note to the effect of:
> =========
>    The WebSocket protocol is designed with an assumption that
>    TCP port 80 or 443 will be used for the sake of tunneling raw
>    socket exchanges over HTTP.  The result is a convoluted and
>    inefficient exchange of hashed data for the sake of bypassing
>    intermediaries that may be routing, authenticating, filtering,
>    or verifying traffic on those ports.  The sole reason for using
>    ports 80 and 443, and hence requiring the hashed data exchange,
>    is because many organizations use TCP port blocking at firewalls
>    to prevent unexpected network traffic, but allow the HTTP ports
>    to remain open because they are expected to be used for normal
>    Web request traffic.  WebSocket deliberately bypasses network
>    management constraints in order to enable Web application
>    developers to send arbitrary data though a trusted port.
>    Naturally, the WebSocket protocol does not have the same network
>    characteristics as HTTP.  The messages exchanged are likely to
>    be smaller, more interactive, and delivered asynchronously over
>    a long-lived connection.  Unfortunately, those are the same
>    characteristics of typical denial-of-service attacks over HTTP.
>    Organizations deploying WebSockets should be aware that existing
>    network equipment or software monitoring on those ports may need
>    to be updated or replaced.
> =========
> Cheers,
> Roy T. Fielding                     <>
> Begin forwarded message:
>> From: "Roy T. Fielding" <>
>> Date: March 29, 2011 5:23:33 AM PDT
>> To: Server-Initiated HTTP <>
>> Cc:
>> Subject: reuse of port 80/443 in hybi
>> I am finding it difficult to participate in hybi in any meaningful
>> way due to the very poor assumption that websockets traffic should
>> use the same ports as Web traffic.  Apparently, this "decision" was
>> made on the basis of hums at an in-person WG meeting and the chairs
>> believe it to be consensus (and thus quash any discussion that has
>> apparent consensus due to the extent to which people keep bringing
>> up old issues).  It might even make some sense, given the name of
>> this working group.
>> Unfortunately, it is a fatal error.  The rest of the protocol
>> discussion is predicated on it, and enormously complex, for the
>> sole reason of that initial error in design.  More the pity.
>> It assumes that the network infrastructure that currently
>> monitors and balances traffic over 80/443 is going to instantly
>> adapt to TCP-over-HTTP, as opposed to treating it like a denial
>> of service attack.
>> Browsers are fully capable of opening up new ports in firewalls
>> simply by concerted use of open standards.  Many other applications
>> do so without this painful corruption of existing protocols. Yes,
>> it takes time (but not as much time as one would think).  Yes,
>> there will be some companies that forcibly block some ports,
>> just like there are some companies that forcibly block HTTP
>> sites like  That is their right.  If the protocol
>> is safe to use, it will be deployable over time.  If not, then
>> it shouldn't make the Web situation worse by increasing the
>> amount of packet filtering at firewalls.
>> So, I don't think the hybi work is worth continuing.  The rest of
>> the protocol decisions simply don't matter -- any of the already
>> deployed proprietary hacks are better by default because they
>> are no worse than hybi and don't have the imprimatur of the IETF.
>> I'd rather develop a protocol that works with network administration
>> rather than against it.
>> I only ask that an IESG note be added to the final specification
>> to the effect that this protocol knowingly misuses the Internet
>> for the sake of bypassing organizational security.  Be honest and
>> let the admins make their own decisions.
>> Cheers,
>> Roy T. Fielding                     <>
> _______________________________________________
> Ietf mailing list