Subject: [hybi] Connection-level extensions

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 06 Apr 2011 00:51:11 +0200

Hi,

  I gather from the threads on how masking makes the deflate-stream ex-
tension perform much worse that the extension is essentially a deflate-
tunnel that wraps around the Websocket frames. I am not sure people are
aware this kind of extension is even possible and there are problems
with them, for instance, the current draft does not really mention this
as a possibility and you can't write intermediaries that need to under-
stand parts of the protocol without having to upgrade them for each new
extension.

For `deflate-stream` in particular it's not even very useful to work in
this manner due to masking, and since masking does not actually random-
ize the content that is sent, it would also seem to defeat masking. De-
flation compresses by replacing repeated sequences with references, and
the chosen masking scheme allows attackers to produce repeated sequences
so it may be quite possible to generate messages deflation turns into a
desired sequence of bytes, if the deflate implementation is predictable.

It seems odd to me that everybody is okay with having connection-level
extensions at all, and having the `deflate-stream` extension designed in
this manner in particular. In any case, this should be mentioned promi-
nently in the specification.

regards,
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Greg Wilkins <[email-masked]>
Date: Wed, 6 Apr 2011 09:24:40 +1000

> nently in the specification.

I'm not OK with it.

I think that we should not have anything that changes the framing -
not masking, not deflate-stream and certainly not arbitrary x-my-hack
extensions.

If we want websockets to be a success then we need to encourage a rich
eco system in tools, aggregators, offloaders, debuggers, etc. etc.
Having non-fixed framing is not helpful for that and will just result
in websockets being treated as an opaque stream or blocked.

cheers

---

From: Brian McKelvey <[email-masked]>
Date: Tue, 5 Apr 2011 16:27:14 -0700

I agree.

Brian

Sent from my iPhone

On Apr 5, 2011, at 4:24 PM, Greg Wilkins <[email-masked]> wrote:

> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi