Subject: [hybi] Discussion with John Tamplin (was Re: Computation part of handshake)

From: Silvio Ventres <[email-masked]>
Date: Fri, 25 Feb 2011 19:08:32 +0200

> This is actually a whole family of cross-protocol attacks.  Using
> WebSockets to avoid the same-origin restrictions of HTTP as accessed
> from a browser is just one category of this attack.  As an example of
> the sort of cross-protocol attacks we want to avoid, see where HTTP
> POST was used to send spam via vulnerable SMTP servers.  Imagine if
> hostile JS could communicate with an SMTP server to send spam just by
> browsing to the attacker's web page.

If POST can do that, there's no reason to prevent WS from doing that.
If POST cannot do that, using POST headers in WS will prevent that too.

---- rant ----

> As a newcomer, constantly asking us to provide you with proof of
> everything that has been decided so far is getting tiresome.  Do you

You waste more time fighting that it would take to actually answer the
questions.

> contributions are certainly welcome, but so far the tone has simply
> been "this is ridiculous and I don't see why it is there, please
> remove it".

The tone has been:
"please provide an example of why this is useful. If examples cannot
be provided,
and thus it is not useful, please remove it".

If you have any actual information to provide, please do that.
If you want to rant, please do it in private.

--
 silvio

---

From: Willy Tarreau <[email-masked]>
Date: Fri, 25 Feb 2011 18:19:56 +0100

[ first, maybe we could remove Chairs from this {end|use}less thread ? ]

> You waste more time fighting that it would take to actually answer the

I think John is not fighting but has tried to do the same as several other
WG members : try to give you simple and understandable examples. Either
you can't understand them or you don't want to. I think the later. Your
questions are extremely vague and you got several precise responses. What
else do you want ?

> be provided, and thus it is not useful, please remove it".

What make you think you could expect that a few tens of persons are
suddenly forced to try to educate you ? All you could show till now
is that you don't want to understand the protocol basics. Please get
a bit more knowledge on how HTTP works and what of its limits WS is
trying to overcome, then I think your requests will be received with
more care because they will become a bit more understandable.

Thanks,
Willy