Re: [hybi] Resolving Issue 11 - Amateur programmer requirement [was: Extensibility mechanisms?]

[Willy Tarreau <[e-mail]>]

On Fri, Jul 23, 2010 at 07:55:06AM +0200, Julian Reschke wrote:
> On 23.07.2010 06:50, Ian Fette (????????????????????????) wrote:
> >The amateur programmer argument keeps coming up. Search google for hybi
> >amateur programmer. It's been raised as an argument against suggestions
> >that are meant to help the protocol scale, it's been raised in
> >discussions of keepalives, it's been raised in multiple framing
> >discussions... I'm not arguing it's a great construct. I don't actually
> >agree that we should be designing for an amateur programmer. What I'm
> >saying is that I do believe that this issue being outstanding is
> >preventing further progress on other issues, so I want to see it put to
> >rest.
> >...
> 
> +1

+1

Also, IMHO there's a contradiction between the fact that we're trying to
do our best to ensure that the protocol prevents any form of cross-proto
attacks, and the protocol is easily implementable by "amateurs" (which I
parse as "the guys who want a quick and dirty implementation and who
don't mind about small side effects as long as it works").

I think that most of the ML subscribers have already written in a hurry
very simple shell script based web servers to be run from inetd and
which did not care about the method, "../" in file names, permissions,
keep-alive, content-length, etc... This is exactly what is permitted by
the simplicity of the HTTP protocol : easy, possibly incomplete and
possibly insecure implementations for amateurs.

If we want amateurs to be able to make full and complete implementations
of WS, then we'll always be limited in the features and security level
(and we'll never agree on what the amater is able to do). If we define
an extensible protocol that amateurs can implement partially because
they only care about the most common denominator, then we have no
problem adding new features and improving security.

While HTTP talks about "implementations", meaning that everyone might
implement a different subset of it, WS seems to focus only on one way
to get it right. This strict view is probably what will finally make
it hard for amateurs to implement it right !

Willy