Re: [rtcweb] Resolving RTP/SDES question in Paris

[Randell Jesup <[e-mail]>]

On 3/17/2012 12:13 AM, Ravindran, Parthasarathi wrote:
> Randell,
>
> In my usecase, the application will not be able to access the website without VPN connection . Please explain your bid-down attack in my usecase.

It may not in your particular case.  But the application would have to 
know the connection was over VPN and somehow verify that (how?)  Careful 
about saying "the server can't be accessed unless the VPN is up" because 
traffic can be spoofed (and not just DNS traffic) if the attacker 
controls the first router/etc.

The solution has to be solid without the user having to verify things 
and such that there isn't a high likelihood of minor mistakes 
compromising the user's security.

> You can speculate that all intranet in the world shall be broken in a moment if they use HTTP but IMO, it is just speculation. IETF specification has to be generic enough to serve all the deployment rather than handling some specific mechanism or application only.

Well, no, IETF specs do not have to serve "all" deployments or 
applications.  That's why we try to agree to use-cases and have goals.  
Often trying to solve *all* variations or cases leads to a 
never-finished, too-complex design.  It can at times be better to focus 
on a few related or similar cases that we know there's a need for, and 
later specs can extend it or provide alternatives.

Of course, we try to include as wide a range of uses as possible, and so 
your use-case may be included, but I don't think we included it in our 
use-case document last fall.

-- 
Randell Jesup
[e-mail]