IETF Logo Mail Archive

Re: [hybi] [Technical Errata Reported] RFC6455 (3215)

Barry Leiba <barryleiba@computer.org> Mon, 07 May 2012 01:03 UTC

Return-Path: <barryleiba@gmail.com>
X-Original-To: hybi@ietfa.amsl.com
Delivered-To: hybi@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C3D621F853D for <hybi@ietfa.amsl.com>; Sun, 6 May 2012 18:03:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.977
X-Spam-Level:
X-Spam-Status: No, score=-102.977 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 32qmUx7TkffH for <hybi@ietfa.amsl.com>; Sun, 6 May 2012 18:03:19 -0700 (PDT)
Received: from mail-ob0-f172.google.com (mail-ob0-f172.google.com [209.85.214.172]) by ietfa.amsl.com (Postfix) with ESMTP id E5F3021F851B for <hybi@ietf.org>; Sun, 6 May 2012 18:03:18 -0700 (PDT)
Received: by obbeh20 with SMTP id eh20so8969302obb.31 for <hybi@ietf.org>; Sun, 06 May 2012 18:03:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=mF/MRROiORy+ck7KIa/JA+4amsQlPkoHVE58u0LQf8Q=; b=R8cFZmNBKPHgH/+5oU0twLLmzIp9KU8bJxt+m6OzZFTzaX2wBubvAdu1jwteCAAOqD wXtwfCtnfafPmJeO3CLX0t8hxttndaecC3LcBSG1yDdHom9uCXUODjI/B87hb+QJnZ8R HtS2ZnY6GDDvY+EspQo5H4tFQLVlzAyUnpRFTe46B1SapEj7VDP/UVR8eS/9OJZXDR6Q e+EmtX2pMIpvrcnaGe1AZ5a93CPIMLbk4ugyoxIy0tD0s0FLkf3TmLt2f45BzWiNIyvw LZCRbQ6jG8KAFiphcegYs11zclATwb7tKp/E6Qq8Q53MuvHZYUhyOn7NN2AuX5koPBEW XqoA==
MIME-Version: 1.0
Received: by 10.60.11.166 with SMTP id r6mr12676073oeb.2.1336352593464; Sun, 06 May 2012 18:03:13 -0700 (PDT)
Sender: barryleiba@gmail.com
Received: by 10.60.10.68 with HTTP; Sun, 6 May 2012 18:03:13 -0700 (PDT)
In-Reply-To: <4FA71E33.3020608@stpeter.im>
References: <20120507003008.A70F2B1E002@rfc-editor.org> <4FA71E33.3020608@stpeter.im>
Date: Sun, 06 May 2012 21:03:13 -0400
X-Google-Sender-Auth: WzOmU4UccEWNTJCBjppfy1mCSkU
Message-ID: <CALaySJLuUsHMMNhEych3eiBYcH5QwqO1QoWt8YN+x6cM5ds4Dg@mail.gmail.com>
From: Barry Leiba <barryleiba@computer.org>
To: Peter Saint-Andre <stpeter@stpeter.im>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Cc: hybi@ietf.org, ifette+ietf@google.com, Gabriel.Montenegro@microsoft.com, jesse.katzman@gmail.com, presnick@qualcomm.com
Subject: Re: [hybi] [Technical Errata Reported] RFC6455 (3215)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 07 May 2012 01:03:19 -0000

> IMHO this is not really a valid erratum, although it's a worthy topic
> for discussion if and when this working group (or a successor working
> group) decides to work on a document that might supersede RFC 6455.

Absolutely -- not appropriate for the errata system.  I'm going to
reject this erratum, and suggest that the submitter participate in the
HyBi working group instead.

Barry, responsible AD

> On 5/6/12 6:30 PM, RFC Errata System wrote:
>>
>> The following errata report has been submitted for RFC6455,
>> "The WebSocket Protocol".
>>
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata_search.php?rfc=6455&eid=3215
>>
>> --------------------------------------
>> Type: Technical
>> Reported by: Jesse Katzman <jesse.katzman@gmail.com>
>>
>> Section: 5.3
>>
>> Original Text
>> -------------
>> The unpredictability of the masking key is essential to prevent authors of malicious applications from selecting the bytes that appear on the wire.
>>
>> Corrected Text
>> --------------
>>
>>
>> Notes
>> -----
>> I don't see how the client-to-server masking prevents "authors of malicious applications from selecting the bytes that appear on the wire".
>>
>> Maliciously changing the contents of a message simply requires a few more steps than it would without masking, as far as I can tell.
>>
>> I'm quite new at networking, so perhaps I'm missing something.  Thank you.
>>
>> Instructions:
>> -------------
>> This errata is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party (IESG)
>> can log in to change the status and edit the report, if necessary.
>>
>> --------------------------------------
>> RFC6455 (draft-ietf-hybi-thewebsocketprotocol-17)
>> --------------------------------------
>> Title               : The WebSocket Protocol
>> Publication Date    : December 2011
>> Author(s)           : I. Fette, A. Melnikov
>> Category            : PROPOSED STANDARD
>> Source              : BiDirectional or Server-Initiated HTTP
>> Area                : Applications
>> Stream              : IETF
>> Verifying Party     : IESG
>> _______________________________________________
>> hybi mailing list
>> hybi@ietf.org
>> https://www.ietf.org/mailman/listinfo/hybi

v2.23.0 | Report a Bug | By Email