Re: [hybi] Masking only Payload/Extension Data

[Willy Tarreau <[e-mail]>]

On Thu, Mar 10, 2011 at 02:25:28AM -0800, Brian wrote:
> By my count, we have six voices in favor so far, including myself:
> Andy Green
> Ytaka Takeda
> Greg Wilkins
> Willy Tarreau
> Joel Martin
> Brian McKelvey
> 
> One on record as not having a strong opinion one way or the other:
> Ian Fette
> 
> And one opposed:
> Adam Barth
> 
> 
> Adam's curt and patronizing reply is once again unenlightening as to
> any viable reason why we need to mask the frame header as well as the
> payload, beyond just his gut feeling on the matter.  I'd like to
> re-assert that since the only field under a potential hacker's control
> is the length (and potentially rsv bits via undefined extensions in
> the future) that the practical possibility of the frame header being
> used for an attack that actually accomplishes anything is so remote
> it's utterly laughable.

I'd like to add that it's important to remember that this controllable
length is not even at the beginning of the frame, and that there are
uncontrollable bytes before.

Regards,
Willy