Subject: [hybi] regarding draft-montenegro-hybi-upgrade-hello-handshake-00

From: "Thomson, Martin" <[email-masked]>
Date: Thu, 16 Dec 2010 09:24:58 +0800

I like this.  I can't speak with authority about its ability to deal with the full spectrum of attacks we've seen, but it certainly looks like it covers the most obvious and worst.

If this works, then rather than aiming this squarely at websockets, it might even make sense to have this describe how to upgrade HTTP in general, with websockets as the canonical example.

Regarding the handshake.  I'd like to see the server echo the client nonce.  That reduces the amount of state that a client might have to maintain.  Not a big deal for a browser, but it would be a nicety for intermediaries.