Re: Performance analysis questions

• Mail folder: WWW Talk Apr 94-present
• Next message: name: "learning html? "
• Previous message: Guido.van.Rossum@cwi.nl: "Re: Python: (was: Re: file i/o api for URL) "
• Maybe in reply to: Daniel W. Connolly: "Re: Performance analysis questions "
• Reply: Simon E Spero: "Re: Performance analysis questions "

Errors-To: listmaster@www0.cern.ch
Date: Sun, 15 May 1994 16:01:14 +0200
Errors-To: listmaster@www0.cern.ch
Message-id: <199405151356.JAA00832@n8kei.tiac.net>
Errors-To: listmaster@www0.cern.ch
Reply-To: payne@n8kei.tiac.net
Originator: www-talk@info.cern.ch
Sender: www-talk@www0.cern.ch
Precedence: bulk
From: Andrew Payne <payne@n8kei.tiac.net>
To: Multiple recipients of list <www-talk@www0.cern.ch>
Subject: Re: Performance analysis questions 
X-Listprocessor-Version: 6.0c -- ListProcessor by Anastasios Kotsikonas

Daniel Connolly writes:

>HTTP is not Internet Mail. HTTP is a protocol based on a reliable byte
>stream, such as TCP. A reliable byte stream does not munge
>whitespace. It doesn't lose characters because it translated to EBCDIC
>and back.
>HTTP is not for the human eye: it's for a piece of software that groks
>TCP (or perhaps some other reliable transport eventually...).

I agree 100%, and this raises an important point for implementors:  "be
conservative in what you send, but liberal in what you accept."

Specifically, implementations should NOT assume that the far end is 
strictly conforming to the standard.  Failure to do so can result in 
nasty surprises and *security holes*.  This is a good place to invest
in defensive programming.

As an example, here's NCSA's HTTPD code for parsing '%' escaped sequences 
in URLs and arguments (sorry to pick on you again, Rob):

    for(x=0,y=0;url[y];++x,++y) {
        if((url[x] = url[y]) == '%') {
            url[x] = x2c(&url[y+1]);
            y+=2;
        }
    }

This code assumes that the '%' is always followed by two characters.  If it 
isn't (i.e. the '%' is one of the last two characters in the string), the 
loop will jump past the null at the end of the string.  The result is a 
garbage error message, a core dump, or worse, the beginnings of a 
stack-overwriting security hole.  Try typing "GET %" at your server 
implementation.

>It is not the case that there are 1000s of broken HTTP implementations
>out there that we need to support. There are perhaps 10 or 20, with 2
>or 3 represending 99% of the traffic.
>Let us keep the HTTP protocol clear and free of such kludgery.

One of the best ways to enforce standard implementations is to have a good 
test suite that checks for conformance.

-andy