Re: [RAI] [dispatch] MSRP Expert Review of draft-pd-dispatch-msrp-websocket-04

[Ben Campbell <[e-mail]>]

On Jan 29, 2014, at 10:42 AM, Iñaki Baz Castillo <[e-mail]> wrote:

> 2014-01-29 Cullen Jennings (fluffy) <[e-mail]>:
>> I don’t see why using websockets would require us to get rid of the MUST use TLS.
>> 
>> The security of relays is a total disaster if you don’t have this so if the MUST be security authenticated goes away for relays, then I suspect this mechanisms is too broken to publish.
> 
> Neither I understand why the "MUST use TLS" should be dropped for MSRP
> over WebSocket. I cannot figure out any reasons for getting rid of
> that requirement. If it was valid and appropriate for MSRP over TCP
> then it should also be for MSRP over WebSocket.

The argument (I'm just relaying it, not making it) has been that Websocket implementations do not give the application that level of control over the security aspects of a connection. One could counter-argue that this means those implementations are not appropriate for MSRP (I'm on the fence on that one.)

Can the authors elaborate on the implementation issues? For example, do WebSocket implementations properly handle things like HTTPS URLs?


> 
> Just my opinion.
> 
> 
> -- 
> Iñaki Baz Castillo
> <[e-mail]>