Re: [hybi] Extensibility mechanisms?

[Scott Ferguson <[e-mail]>]

Adam Barth wrote:
> I don't think you understand how cross-protocol attacks work, and I'm
> not that interested in educating you about them.  HTTP POST requests
> are also very poorly designed in this way and have been the cause of a
> number of cross-protocol attacks, most recently against IRC.
>   
Well, we have two conflicting desires that need to be resolved:

  1) To make WebSockets initial latency no worse than HTTP. (If I 
understand correctly, this is the issue raised by Jamie and also Greg.)

  2) cross-site scripting

I see only 3 possible resolutions:

  a) That 1 & 2 are irreconcilable and WebSocket performance must be 
worse than HTTP/comet because its security must be better than HTTP.

  b) WebSocket performance must be as good as HTTP/comet as long as its 
security is no worse than HTTP.

  c)  Both 1 & 2 are resolvable and the solution is XXX.

If (a) or (b) are selected, it should be a conscious decision, not 
chosen by default. I assume you're in camp (a)?

If you believe (c), than it seems to me you either need to propose an 
XXX or suggest fixes to a flawed XXX proposal to make it work.

The current official draft proposes (a), but it seemed to me that the 
group is divided on the issue, and I made an attempt at an XXX. Perhaps 
I misunderstood, everyone's in camp (a).

-- Scott

(I suppose there might be a (d): browser clients are restricted to (a) 
but non-browser clients can use (b). But that would probably be too 
messy for a spec.)
> Adam
>
>
>
>