[AVT] Re: Comments on draft-ietf-avt-rtp-vc1-02

Anders Klemets wrote:
>>>>T1. Will it be possible to carry any type of active content (like 
>>>>scripts or Java code) in the VC-1 user data? If that is the case
> 
> there
> 
>>Yes, sorry, I meant RFC 3640 that contains such paragraphs in its 
>>security consideration section.
> 
> 
> I can understand that RFC 3640 needs to discuss security, because
> MPEG-J, BIFS, etc., are part of the MPEG-4 spec itself.  The VC-1
> user-data, on the other hand, is registered separately by SMPTE.  
> 
> VC-1 user-data is actually identical to the MPEG-2 user-data.  And RFC
> 2250 (MPEG-2 RTP Payload Format) doesn't mention user-data as a security
> risk.

Okay, does MPEG-2 user data allow scripting or other active content? If 
that is the case I would like to have warning about also that, similar 
to the last paragraph in section 5 of RFC 3640.

That RFC 2250 lacks this is of course not good, but hardly surprising. 
We have gather quite a lot of experience since 1998. Also we are raising 
the bar for our standard tracks RTP payload formats in all regards.

> 
> In my opinion, putting a warning about user-data is a little bit like
> putting a warning against downloading binaries in the HTTP spec, or
> putting a warning about telemarketer scams in the SIP spec. :-)
> 
> Nevertheless, I have written the following paragraph, to be added to the
> VC-1 security considerations section:
> 
> "VC-1 bit streams can carry user-data, such as closed captioning
> information and content meta-data.  VC-1 requires identifiers for
> user-data to be registered with SMPTE.  Depending on the type of
> user-data, it might be possible for a sender to generate user-data in a
> non-compliant manner to crash the receiver or make it temporarily
> unavailable.  Senders that transport VC-1 bit streams SHOULD ensure that
> the user-data is compliant with the specification registered with SMPTE
> (see Annex F of [1].)  Receivers should prevent malfunction in case of
> non-compliant user-data."
> 
> Does it look OK?

I think you should use upper case SHOULD also in the last sentence. In 
addition we need to know if MPEG2 user data may contain active content 
to determine if also that needs to be included.

Cheers

Magnus Westerlund

Multimedia Technologies, Ericsson Research EAB/TVA/A
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Torshamsgatan 23           | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: magnus.westerlund@ericsson.com

_______________________________________________
Audio/Video Transport Working Group
avt@ietf.org
https://www1.ietf.org/mailman/listinfo/avt