Re: [rtcweb] URI schemes for TURN and STUN

[Marc Petit-Huguenin <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Martin,

So I understand Roy's email as saying in fact the opposite of what Harald said,
i.e. that using an "s" suffix to signify security is a good thing.

What is your opinion on defining a generic scheme suffix (i.e. "+s" or "+sec")
that would indicate a well defined set of security properties that could apply
to any scheme, (vs the current "s" suffix where security properties has to be
defined scheme by scheme)?

Also, what would be the best place to discuss this?

Thanks.

On 10/30/2011 08:26 PM, "Martin J. Dürst" wrote:
> For the http vs. https case, there is a very good answer from Roy Fielding at
> http://lists.w3.org/Archives/Public/www-tag/2006Mar/0040.html
> 
> In essence, not distinguishing the two schemes would mean either additional
> roundtrips (assuming http is the more frequent one) or exposition of data on the
> network that was supposed to be private.
> 
> Regards,    Martin.
> 
> On 2011/10/30 13:40, Harald Alvestrand wrote:
>> On 10/29/2011 04:23 PM, Marc Petit-Huguenin wrote:
> On 10/29/2011 03:36 PM, Iñaki Baz Castillo wrote:
>>>>> 2011/10/29 Harald Alvestrand<[e-mail]>:
>>>>>> - I do not think it's appropriate to use "turn" and "turns" for
>>>>>> indicating
>>>>>> transport. Polluting the URI namespace with more configuration
>>>>>> parameters in
>>>>>> the form of trailing "s" is a Bad Thing.
>>>>> But there should be some way to indicate that a TURN server listens in
>>>>> TLS, right?
>>>>>
> We should continue this discussion in BEHAVE, but I would like to ask
> the OP to
> send a pointer on the RFC or discussion that says that using a
> trailing "s" to
> indicate security is a bad thing.
>>> I'll have to forward this question to the apps ADs of a few years ago
>>> about whether there's documentation for it. It does not seem to have
>>> been captured in an RFC that I can find; discussion was in the
>>> ~2000-2005 timeframe.
>>>
>>> The short version, from memory: Doing "s" locks you into one and exactly
>>> one security scheme, and prevents you from saying anything about the
>>> requisite parameters for that scheme, while using AUTH parameters such
>>> as POP or in-band negotiation such as IMAP are much more flexible
>>> approaches.
>>>

- -- 
Marc Petit-Huguenin
Personal email: [e-mail]
Professional email: [e-mail]
Blog: http://blog.marc.petit-huguenin.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk6ut2kACgkQ9RoMZyVa61c3WQCeJVI5ov93J+RUp9xQvcggz8uf
J8gAoJ2I4kAA1lGIOij6GTJmsbe4WEpg
=n4RK
-----END PGP SIGNATURE-----