Re: [hybi] Extensibility mechanisms?

[Ian Hickson <[e-mail]>]

On Sat, 17 Apr 2010, Justin Erenkrantz wrote:
> On Fri, Apr 16, 2010 at 1:13 PM, Ian Hickson <[e-mail]> wrote:
> > ideal deployment the connection is wrapped in end-to-end TLS, so the
> > intermediaries can't do anything with it. There were only two reasons for
> 
> It may be appropriate to say it is end-to-end TLS at an organizational
> level (ie user to origin)

Right, that's what I meant (though "origin" may be the wrong word to use 
here, given its meaning in the Web security sphere).


> but my experience is that most reverse proxy deployments perform TLS 
> termination on the edge of the network so that load balancing techniques 
> can be applied inside the network without TLS overhead.  So, I believe 
> it is very unlikely to expect that there will always be end-to-end TLS 
> at scale - the intermediaries will be relied upon to provide critical 
> load-balancing and failover mechanisms even for Web Socket.  -- justin

For all intents and purposes, the server is everything under control of 
the end point authority. It doesn't matter if the "server" conformance 
class is implemented by a 486 PC sitting under a desk using only userland 
Ruby code running on Linux or if it's implemented by a mixture of 
dedicated hardware in a datacenter providing load-balancing to an array of 
high-end servers running a custom clustering OS. The spec explicitly 
states that conformance requirements are essentially "black box" 
conformance requirements. It doesn't require the server to use a single 
processor; the TLS, Web Socket, and subprotocol handshakes could all be 
handled by completely different machines on different coasts, so long as 
the end result is indistinguishable from what the spec requires.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'