[boost] [beast] Platform proxy settings, SSL verification

Subject: [boost] [beast] Platform proxy settings, SSL verification
From: Phil Endecott (spam_from_boost_dev_at_[hidden])
Date: 2017-07-01 17:02:04

Here are just a few quick comments re Beast:

1. It's a terrible name, but I believe others have already
mentioned that.

2. I don't believe there is any integration with platform proxy
settings.  I'll explain:

I have my own basic HTTP client and server code that I've used in
a handful of projects.  There are a few features that it lacks that
have caused me problems.  In particular, when I tried to use my
HTTP client code in an iOS app, it worked on WiFi networks but not
on some cellular networks.  After much remote debugging I realised
that some cellular carriers in some countries require that HTTP
traffic goes via a (non-transparent) proxy.  If you use the iOS
http client then this is handled for you, but my code knows nothing
about it.  For me to test a fix for this I would have had to fly
to another continent....

This is the sort of thing that is particularly valuable in a
Boost library: I try to write portable code, but I don't know the
details of every platform that it will run on or even have test
systems available to me.  Having a library that knows about the
platform-specific details, and which has been tested on a wide
variety of those platforms, is very valuable.  (And a library
that instead just does the "easy parts" is something that I could
have written, or already have written, myself.)

3. Finally a comment about the SSL example at
https://github.com/vinniefalco/Beast/blob/master/example/http-client-ssl/http_client_ssl.cpp

This says stream.set_verify_mode(ssl::verify_none);

Please correct me if I'm wrong, but I think that means that it does
not do any sort of certificate verification.

As a matter of principle, I think that the *first* SSL example
should show how to establish a properly-secure connection.  See for example
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf (""The Most Dangerous
Code in the World: Validating SSL Certificates in Non-Browser Software")
and e.g. https://lwn.net/Articles/522111/ for discussion.  A quick look
at http://www.boost.org/doc/libs/1_47_0/doc/html/boost_asio/overview/ssl.html
suggests that this might add as few as two more lines to the code.

Regards, Phil.