Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

WebSockets also have the advantage that they pass through corporate firewalls and open wifi networks, as well as many proxies, as they masquerade as HTTP traffic. And a nicer frames mechanic than raw socket, something I love. (nowhere near as low-level, but for me it's essentially stateful UDP that's reliable, i.e. TCP except with datagrams)


Corporate firewalls are the general boogieman, but in reality, I haven't seen evidence that they're much more than that.

To test this, we implemented fallback-to-HTTPS behavior in a very widely used previously non-HTTP client. We then observed the number of clients that failed to connect via our custom protocol, but succeeded in falling back to HTTPS.

The numbers were negligible.

It's ridiculous that we'd seriously believe that we can't trust that TCP works on the internet. We joke about it being the "interweb", but I see no reason to sow fear, uncertainty, and doubt, and thus and actually turn the interweb into reality.


Perhaps, but open wifi often only allows 443 and 80.


That also breaks IMAP(S), SMTP(S), Jabber, AIM, and a slew of other applications.

I don't see that we should model the internet architecture on bad technical choices made on a limited number of open wifi networks.

Or, we just frame our standard protocol over websockets as an (unfortunate) fallback, if it ever is revealed to be a real problem.


Port numbers are not protocols.


Yes, but many open wifi hotspots at commercial institutions only have 80 and 443 open.


I believe his point is that you can generally carry whatever protocol you want over port 443 (and often port 80).

Given how many other things are broken by networks that foolishly only open port 80 and 443, and their (in my experience) relative rarity, I'd suggest that it's not worth bothering with, except possibly as a fall-back to measure the actual number of people trying to use your service behind such a network.


Who says port 80 has to be http?


I think 443 will be a better example because (I think) it's harder for a middle party to profile https and see that it is indeed https and not something else.


I don't think so, even with https, you still have the handshake which middle parties can see.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: