Subject: [hybi] issuing working group last call on draft-ietf-hybi-thewebsocketprotocol-07 (until May 9)

From: Gabriel Montenegro <[email-masked]>
Date: Sun, 24 Apr 2011 22:42:31 +0000

This message initiates a two-week working group last call (WG LC) on draft-ietf-hybi-thewebsocketprotocol-07 to be completed on May 9:

http://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-07

At this point, we know there are some issues that still need to be resolved during WG LC. One issue is  a request for more detailed error handling from both Alexey Melnikov and Simon Peters. Another is to check the interaction and hooks with the API, as raised by both Ian Hixon and Simon Peters. We also need to decide what new IANA registries are needed (if any) as raised by Alexey Melnikov.

Another issue is to address all ID NITS:
http://tools.ietf.org/idnits?url=http://tools.ietf.org/id/draft-ietf-hybi-thewebsocketprotocol-07.txt

To clarify to those unfamiliar with the IETF process, this WG LC is a final check within the working group to prepare the core protocol as defined in the 07 version of the document for subsequent submission to the IESG.

Thanks,

Salvatore and Gabriel

---

From: Greg Wilkins <[email-masked]>
Date: Wed, 27 Apr 2011 11:43:39 +1000

On 25 April 2011 08:42, Gabriel Montenegro
<[email-masked]> wrote:
> At this point, we know there are some issues that still need to be resolved
> during WG LC. One issue is  a request for more detailed error handling from
> both Alexey Melnikov and Simon Peters. Another is to check the interaction
> and hooks with the API, as raised by both Ian Hixon and Simon Peters. We
> also need to decide what new IANA registries are needed (if any) as raised
> by Alexey Melnikov.

Gabriel,

I would also like my two proposal in the "Fragment and extensions"
topic to be considered in this period.

regards

---

From: Greg Wilkins <[email-masked]>
Date: Thu, 28 Apr 2011 12:56:17 +1000

Gabriel & Salvatore,

I think it is premature to put the protocol forward for a last-call
because it still incomplete and contains significant flaws:

 + Unaddressed security concerns have been raised the deflate-stream
extension - namely that payloads could be designed so as to subvert
the masking and allow an attacker to send arbitrary byte patterns on
the wire.   So either this is a significant risk  - or else there is
no need for masking.

 + There are no mechanisms to resolve allocation of reserve bits
and/or opcodes between extensions. Development and trial of private
extensions will be severely limited without such resoution.  Large
vendors will be able to make "land grabs" for these reserve bits and
opcodes and prevent the development of alternate extensions simply by
their market force.

 + The specification is not internally consistent:
    - One of the identified goals of the fragmentation feature is to
support MUX, yet the inability to interleave fragments means that
fragments cannot be used for MUX.
    - The exemplar extension included in the spec (deflate-stream)
does not follow any of the anticipated uses identified in 4.8 and
breaks the framing
    - The removal of extension-data from the specification has only be
partially completed in draft-7 and there are still many references to
it in ABNF and text.

There are simple solutions being proposed for these issues do not need
significant changes to the protocol.  The existence of the last call
is now being used as an argument to defer further consideration of
these issues/solutions.

I believe the last call should be repealed or the time extended, so
that we can resolve these remaining issue.

regards

On 25 April 2011 08:42, Gabriel Montenegro
<[email-masked]> wrote:
> This message initiates a two-week working group last call (WG LC) on
> draft-ietf-hybi-thewebsocketprotocol-07 to be completed on May 9:
>
>
>
> To clarify to those unfamiliar with the IETF process, this WG LC is a final
> check within the working group to prepare the core protocol as defined in
> the 07 version of the document for subsequent submission to the IESG.
>
>
>
> Thanks,
>
>
>
> Salvatore and Gabriel
>
>
>
> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi
>
>