Re: [hybi] WebSocket, TLS and intermediaries

[Maciej Stachowiak <[e-mail]>]

On Jul 21, 2010, at 5:21 AM, Willy Tarreau wrote:

> 
> Not necessarily, if we rely on standards and the intermediaries support those
> standards, there is no need for the ends to know about them. Neither your
> client nor your servers are aware of the number of routers and firewalls
> in the chain because the service they offer relies on well established
> standards and they act transparently.

Yes, but the core protocols of the Internet (IP, TCP, UDP, ICMP, etc) have update time scales on the order of decades. Even with exhaustion of the address space staring us down, rolling out IPv6 is a massive engineering undertaking. And indeed, if you try to use IPv6 on your home network today, it will matter to you whether the intermediaries between you and your other endpoint support it.

The bottom line is this: if you allow intermediaries to participate without the explicit knowledge of either endpoint, it may take decades to roll out significant protocol changes. All communication will be reduced to the least common denominator of the worst-behaving intermediaries. That may be a cost worth bearing for low-level protocols, but it is completely unacceptable for an application-level protocol in an area of high innovation.

> The same must be true with intermediaries
> here. By using a standard HTTP handshake, standard-compliant intermediaries
> can work without either of the client or server being aware of it.

And likewise they can (and apparently often will) fail without either the client or the server being aware of it. This mistake has already been made with HTTP, let's learn from it instead of repeating it.

> 
>> We should not support magical transparent intermediaries where neither the client nor server has
>>  an obvious way to detect its existence; in fact we should design the protocol to prevent such intermediaries from being created.
> 
> I disagree here. Intermediaries will be created whatever efforts you put to
> try to make them fail. They will exist because people who deploy them need
> them, and the quality of their implementation is no problem for them.

That's exactly the problem - low-quality intermediaries are not a problem for the people running them, but they create global negative externalities.

Regards,
Maciej