3 ms·

The protocol problems are due to the text-based format and a bizarre desire to make said text format "human friendly". It inherits the stupidity from HTTP (line

The protocol problems are due to the text-based format and a bizarre desire to make said text format "human friendly". It inherits the stupidity from HTTP (line folding, comments in headers) and adds its own fun. The authors actually suggest that the "intent" of the message be followed in case of errors. It's terrible. The packet issues are due to the strange use of UDP with mandatory TCP switching. Needless complexity. Oh and these aren't theoretical. Two big, widely deployed implementations cannot even agree on how headers end, and will read the same message differently. This can be exploited when a network does header processing. Imagine adding a "x-accountid" header, and removing any existing ones - if interpretation differ on what constitutes a header, an attacker can slip fake headers in. Not entirely dissimilar to browser exploits that let script include a header with a newline in the value, letting scripts maliciously set headers they shouldn't be allowed to.

zAy0LfpBZLC8mAC 9y ago
Well, yeah, I certainly didn't mean to say that SIP is a great protocol, it is indeed quite terrible--but still in practice if things don't work, that's usually a result of at least one party not following the spec (which is not really surprising , given all the pointless complexity ... but then that's still not really an excuse to not implement SIP when you are claiming that you do).
- MichaelGG 9y ago
  Practically, it is not possible to implement the spec in an interoperable way. Existing implementations are mutually incompatible. Hence the need for config flags per "trunk". What one system requires, another will reject. Sad but true.
  - zAy0LfpBZLC8mAC 9y ago
    Well, yes. But still, more often than not, when I encounter interoperability problems, if both sides actually did what the spec says, there wouldn't be a problem. SIP itself is quite sad, but in my experience many implementations are even worse than the spec.

zAy0LfpBZLC8mAC 9y ago

Well, yeah, I certainly didn't mean to say that SIP is a great protocol, it is indeed quite terrible--but still in practice if things don't work, that's usually a result of at least one party not following the spec (which is not really surprising , given all the pointless complexity ... but then that's still not really an excuse to not implement SIP when you are claiming that you do).

MichaelGG 9y ago
Practically, it is not possible to implement the spec in an interoperable way. Existing implementations are mutually incompatible. Hence the need for config flags per "trunk". What one system requires, another will reject. Sad but true.
- zAy0LfpBZLC8mAC 9y ago
  Well, yes. But still, more often than not, when I encounter interoperability problems, if both sides actually did what the spec says, there wouldn't be a problem. SIP itself is quite sad, but in my experience many implementations are even worse than the spec.