Re: [hybi] Extensibility mechanisms?

[Jamie Lokier <[e-mail]>]

Adam Barth wrote:
> On Thu, Jul 22, 2010 at 1:04 PM, Scott Ferguson <[e-mail]> wrote:
> > The issue is the number of request/response before the initial payload is
> > sent. If we require the client to wait to validate the server before it can
> > send its payload, the initial performance will be slower than a HTTP POST.
> >
> > That delay may be perfectly acceptable, but some people have raised it as an
> > issue in the group. I'm fine with the delay myself, but I think it should be
> > resolved.
> 
> We need to know the server understands web sockets before spamming
> them with attacker-controlled bytes.  If we don't, we'll repeat the
> long and tragic history of cross-protocol vulnerabilities caused by
> HTTP POST.

Compliant implementations *already* spam the server with
attacker-controlled bytes in the initial handshake.

All proposals to include early payloads are explicitly designed to
tunnel it safely in a way which does no more harm than the initial
handshake.

I don't think I've seen any proposals for an insecure method or
sending arbitrary attacker-controlled bytes early, and I wonder if
you're making an incorrect assumption that.

-- Jamie