Re: [hybi] Extensibility mechanisms?

[Maciej Stachowiak <[e-mail]>]

On Jul 21, 2010, at 6:31 PM, Scott Ferguson wrote:

> Maciej Stachowiak wrote:
>> On Jul 21, 2010, at 5:30 PM, Scott Ferguson wrote:
>> 
>>  
>>> The counterproposal at
>>> 
>>> http://hessian.caucho.com/websockets/draft-ferg-hybi-websockets-latest.html
>>> 
>>> not complicated at all: it's a trivial protocol, and yet it solves the HyBi requirements, including requirements that the current draft ignores, as well as being extensible to muxing requirements.
>>>    
>> 
>> Can you explain how this proposal provides an HTTP-compatible upgrade in the non-TLS case? Or how it provides protection against cross-protocol attacks? I think those are two pretty important requirements, and it is not obvious to me how they are met.
>>  
> The HTTP negotiation was in an earlier draft:
> 
> http://hessian.caucho.com/websockets/draft-ferg-hybi-websockets-m1.html
> 
> The previous non-HTTP link was based on the discussion we had a few months ago for the non-HTTP case, just showing how you could have the handshake as part of the protocol syntax itself.  (And as I mentioned in the other response, my main focus was on the stream part of the protocol. There's nothing interesting or innovative in the handshake.)
> 
> The only thing I changed in the HTTP portion was to make it actually HTTP.
> 
> But focusing on the handshake is really missing the point of that proposal.

You said it solved all the requirements, so I was interested to find out if this was really so. It looks like that is not the case with your current draft, although it does have some nice properties.

Regards,
Maciej