Subject: Re: [hybi] CRLF-less masking proposal

From: Joel Martin <[email-masked]>
Date: Sun, 16 Jan 2011 17:37:27 -0600

Maciej,

I've changed the subject to avoid the poll.

Actually, Moore's origianl writings indicated doubling every year and then
he changed it to every 2 years in 1975. He never claimed every 18 months
(that was an Intel executive David House). In fact it's closer to every 20
months (http://news.cnet.com/2100-1001-984051.html and wikipedia)

But regardless, the point is that last-mile bandwidth and transistors per
inch have both been on an exponential growth curve for at least 3 decades.
In other words, a few percent extra in CPU or bandwidth is quickly made
irrelevant by time. And I think it's important to note that CPU power
increases are no longer as easy to fully utilize since the doubling effect
no longer implies a doubling of CPU frequency but has shifted towards
parallel processing.

On the other hand, the march of time does NOT automatically help security
issues or Internet latency. In fact, as Jim Gettys has been arguing recent,
Internet latency has worsened in the last 20 years for a variety of reasons
(
http://gettys.wordpress.com/2010/12/06/whose-house-is-of-glasse-must-not-throw-stones-at-another/
)

For me (and I think for most) WebSockets is far more about latency than
bandwidth. And more important that either is security. I am concerned about
CPU too, but mostly for the impact it has on latency.

Since base64 or 7-bit/8-bit address the outstanding security concern whereas
the masking options simply mitigate it to varying degrees or another, my
preference is for one of the former. Specifically base64 since the four
languages I am personally concerned about (python, C, Flash AS3, Node.js)
have native base64 routines.

Regards,

Joel Martin

On Sun, Jan 16, 2011 at 2:03 PM, Maciej Stachowiak <[email-masked]> wrote:

>
> On Jan 15, 2011, at 11:02 PM, Joel Martin wrote:
>
> I believe the history of "last mile" since 1979 has shown a doubling every
> 2 years:
>
>
> http://www.cabletechtalk.com/tech-discussions/2008/08/14/broadband-speed-and-moores-law-a-response-to-robb-topolski/
>
>
> And computational power doubles about every 18 months,
>
>
> I think the real point is that adding a few percent to the size of
> WebSockets traffic will quickly be addressed by the natural increase in
> bandwidth (both backbone and last-mile). But security issues don't easily
> fix themselves with time. It seems to me the WebSockets priorities should be
> security, then ease of implementation, then latency, with bandwidth at the
> end of the list.
>
>
> If security is really the top priority, and in particular if it's a higher
> priority than computational complexity, then a making scheme that produces
> data indistinguishable from random is the best choice. As I understand it,
> the base64 proposal is based on the premise that AES-CTR or HMAC are too
> expensive in CPU time to be worth the security benefit.
>
> Regards,
> Maciej
>
>
> Joel Martin
>
> On Fri, Jan 14, 2011 at 4:14 PM, Maciej Stachowiak <[email-masked]> wrote:
>
>>
>> On Jan 14, 2011, at 1:18 PM, Willy Tarreau wrote:
>>
>> > On Fri, Jan 14, 2011 at 01:01:23PM -0800, Maciej Stachowiak wrote:
>> >>
>> >> Using more bandwidth to save CPU strikes me as a poor tradeoff. CPU
>> speeds increase at a faster rate than network bandwidth, or for that matter
>> memory bandwidth.
>> >
>> > Sorry Maciej, but on this point I think you're wrong. Network speed
>> increases
>> > much faster than CPUs and that's even becoming an issue to process
>> frames.
>> >
>> > Some networks I saw migrate from 10 to 100 Mbps 12 years ago are now
>> switching
>> > to 10G, thus a 100x increase. The machines were quad-600 MHz Alphas,
>> we're not
>> > yet at 240 GHz in equivalent servers.
>> >
>> > While derivates from Moore's law indicate performance doubling every 2
>> years,
>> > some ISPs indicate that network bandwidth doubles every 9 months.
>>
>> Maybe on the backbone, but not last mile bandwidth.
>>
>>  - Maciej
>>
>> _______________________________________________
>> hybi mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/hybi
>>
>
>
>

---

From: Anthony Catel <[email-masked]>
Date: Mon, 17 Jan 2011 12:28:05 +0100

I don't understand why some of you are still arguing in favour of something else than a non-CRLF-less masking
while we can have a simple, lightweight and safe CRLF-less masking solution that responds to the initial issue.

Seriously, WTF?

I vote for the light-100%-safe over the heavy-99.9%-random. You?