Subject: [hybi] Mixed Content + WebSockets.

From: Mike West <[email-masked]>
Date: Tue, 23 Jun 2015 09:22:18 +0200

Hello, wonderful members of the HYBI WG!

The W3C's WebAppSec WG is in the process of moving
https://w3c.github.io/webappsec/specs/mixedcontent/ along the path to REC.
That document specifies a small change to the WebSockets protocol
algorithms (
https://w3c.github.io/webappsec/specs/mixedcontent/#websockets-integration),
and it's unclear to me how best to integrate that change with RFC 6455.

mnot@ suggested that an errata probably isn't appropriate at this point,
but that an errata "held for document update" might be a reasonable thing
to do here. I'm fairly incompetent when it comes to IETF process, so I hope
you folks can guide me in the right direction here.

Thanks!

--
Mike West <[email-masked]>, @mikewest

Google Germany GmbH, Dienerstrasse 12, 80331 München,
Germany, Registergericht und -nummer: Hamburg, HRB 86891, Sitz der
Gesellschaft: Hamburg, Geschäftsführer: Graham Law, Christine Elizabeth
Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)

---

From: Salvatore Loreto <[email-masked]>
Date: Wed, 24 Jun 2015 07:27:38 +0000

Hi Mike

I agree with MNOT and I think you should follow his suggestion
an errata “held for document update” basically means that while it is not necessary for the current
version of the protocol, the future version of the protocol should consider the erratum

that means that if the WebSocket over HTTP2 will be started people will have to take in consideration
the errata
to be clear I don’t know if/when and where this effort will be started

br
Salvatore

On 23 Jun 2015, at 10:22, Mike West <[email-masked]<mailto:[email-masked]>> wrote:

The W3C's WebAppSec WG is in the process of moving https://w3c.github.io/webappsec/specs/mixedcontent/ along the path to REC. That document specifies a small change to the WebSockets protocol algorithms (https://w3c.github.io/webappsec/specs/mixedcontent/#websockets-integration), and it's unclear to me how best to integrate that change with RFC 6455.

mnot@ suggested that an errata probably isn't appropriate at this point, but that an errata "held for document update" might be a reasonable thing to do here. I'm fairly incompetent when it comes to IETF process, so I hope you folks can guide me in the right direction here.

Thanks!

--
Mike West <[email-masked]<mailto:[email-masked]>>, @mikewest

Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany, Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg, Geschäftsführer: Graham Law, Christine Elizabeth Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)
_______________________________________________
hybi mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/hybi

---

From: Mike West <[email-masked]>
Date: Wed, 24 Jun 2015 09:40:41 +0200

Thanks, Salvatore! What is the process for submitting such errata?

-mike

On Wed, Jun 24, 2015 at 9:27 AM, Salvatore Loreto <
[email-masked]> wrote:

>  On 23 Jun 2015, at 10:22, Mike West <[email-masked]> wrote:
>
> https://w3c.github.io/webappsec/specs/mixedcontent/ along the path to
> REC. That document specifies a small change to the WebSockets protocol
> algorithms (
> [email-masked]

---

From: Takeshi Yoshino <[email-masked]>
Date: Wed, 24 Jun 2015 17:06:28 +0900

Hi Mike,

Please open http://www.rfc-editor.org/errata.php#reportnew and enter 6455
into the box and click "Report New Errata" button. When a list of existing
errata opens, go to the bottom to find a button to report a new errata.

----

BTW, in
https://w3c.github.io/webappsec/specs/mixedcontent/#websockets-integration

  If secure is true, and the TLS handshake performed in step 5 results in
TLS-protection which is is deprecated,

s/is is/is/;

Takeshi

On Wed, Jun 24, 2015 at 4:40 PM, Mike West <[email-masked]> wrote:

>>  mnot@ suggested that an errata probably isn't appropriate at this
>> point, but that an errata "held for document update" might be a reasonable
>> thing to do here. I'm fairly incompetent when it comes to IETF process, so
>> I hope you folks can guide me in the right direction here.
>>
>>  Thanks!
>>
>>   --

---

From: Salvatore Loreto <[email-masked]>
Date: Wed, 24 Jun 2015 08:12:37 +0000

Hi Mike

here the link to the tool just follow the instructions

http://www.rfc-editor.org/errata.php

br
Salvatore

On 24 Jun 2015, at 10:40, Mike West <[email-masked]<mailto:[email-masked]>> wrote:

-mike

On Wed, Jun 24, 2015 at 9:27 AM, Salvatore Loreto <[email-masked]<mailto:[email-masked]>> wrote:
Hi Mike

br
Salvatore

Thanks!

---

From: Mike West <[email-masked]>
Date: Wed, 24 Jun 2015 10:44:47 +0200

Thanks to you both. Submitted
http://www.rfc-editor.org/errata_search.php?rfc=6455&eid=4398, which
includes the first change. The second might be removed before MIX moves to
REC; I'll wait to see what the WG decides before submitting the second
errata.

> TLS-protection which is is deprecated,

Ah! Thanks. :) Fixed in
https://github.com/w3c/webappsec/commit/f5755c599a27092bb7d1db5245de324939c83534
.

-mike