[hybi] deflate-stream and masking

[Greg Wilkins <[e-mail]>]

As part of my continuing campaign against including deflate-stream in
the specification as a standard extension, I did a quick test of how
well it works when applied to masked frames.

I took a days worth of traffic from an IRC channel and wrapped it up
as JSON messages sent as websocket frames.
There were 487 message that looked like:

     {channel:"#webtide", username:"tbecker", text:"joakime: jenkins
had issues pulling from github a couple of times  last week"}

As an unmasked WS stream, it was 50675 bytes, and as a masked stream
is was 52623 bytes.
I then compressed both these streams with gzip and got 13306 bytes for
unmasked and 51704 bytes for the masked!!!!

So for this very typical example, masking was sufficiently random to
completely negate the benefits of compression.

So the deflate-stream "extension" is:

 + next to useless for inbound traffic
 + breaks all the rules of what an extension can do
 + is potentially vulnerable to injection as attackers can send
repeated patterns that may subvert masking
 + can be replaced by the in-frame compression extension already proposed.
 + was inserted in the draft with little or no discussion and without
clear consensus.

Can I call for a straw poll of who wants to keep this extension in the spec?



regards