Re: [hybi] Extensibility mechanisms?

[Scott Ferguson <[e-mail]>]

Maciej Stachowiak wrote:
> On Jul 21, 2010, at 5:30 PM, Scott Ferguson wrote:
>
>   
>> The counterproposal at
>>
>> http://hessian.caucho.com/websockets/draft-ferg-hybi-websockets-latest.html
>>
>> not complicated at all: it's a trivial protocol, and yet it solves the HyBi requirements, including requirements that the current draft ignores, as well as being extensible to muxing requirements.
>>     
>
> Can you explain how this proposal provides an HTTP-compatible upgrade in the non-TLS case? Or how it provides protection against cross-protocol attacks? I think those are two pretty important requirements, and it is not obvious to me how they are met.
>   
The HTTP negotiation was in an earlier draft:

  http://hessian.caucho.com/websockets/draft-ferg-hybi-websockets-m1.html

The previous non-HTTP link was based on the discussion we had a few 
months ago for the non-HTTP case, just showing how you could have the 
handshake as part of the protocol syntax itself.  (And as I mentioned in 
the other response, my main focus was on the stream part of the 
protocol. There's nothing interesting or innovative in the handshake.)

The only thing I changed in the HTTP portion was to make it actually HTTP.

But focusing on the handshake is really missing the point of that proposal.

-- Scott
> Regards,
> Maciej
>
>
>
>
>