wss forced on spice.html

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

I noticed on the example page https://www.spice-space.org/spice-html5/spice.html
that you are unable to connect to a websocket where SSL is not
implemented. The reason for this is that the original site redirects
to https and the websocet is ws:// not wss://. One is greeted with an
error which states the operation is insecure and it does not attempt
the connection. I haven't tested whether this is true of all web
browsers, I think given this is just an example page it's reasonable
in this case to permit HTTP and HTTPS so develpers are not required to
add SSL to the projects they are developing at early stages.

I am sure there is legitimate disagreement to this position,
especially now that encryption keys are cheaper and more prevalent
than ever, but this is a testing page so tests should be reducible to
the simplest possible level.
Perhaps a message could be included if you are not using HTTPS that
all traffic is not encrypted and susceptible to interception from
attacks, but users can use at their own risk.
In fact, I would see this a greater testing page if http and https
could be selected and tested independently.
_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/spice-devel




[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]     [Monitors]