Re: [rtcweb] Requiring ICE for RTC calls

[Tim Panton <[e-mail]>]

On 26 Sep 2011, at 09:26, Roman Shpount wrote:

> 
> On Mon, Sep 26, 2011 at 11:48 AM, Matthew Kaufman <[e-mail]> wrote:
> And "interoperability with SIP-PSTN providers" is only relevant if you are trying to turn the browser into another phone. We have enough phones. What we don't have are new real-time communication experiences that can only be created within this environment.
> 
> Are we deliberately creating an island? To be honest, I actually wanted to put RTC in the phone, instead of SIP. I think it would be a great idea to have desktop phone which runs a webkit browser with RTC and serves as an advanced display phone for a PBX. If RTC would not support no-ICE non-RTP calls, my only option would be to ignore the standard. So, in a sense we do not have enough phones.

I am confused. Which phones today connect directly to a SIP to PSTN gateway ? I'd guess none. 
Almost all of them go through some registrar and/or proxy.  

> 
> I think you point in a lot of ways is similar to the argument that we should disable HTTP and leave only HTTPS since it is the only secure way to communicate and everything else would be an attack vector.

No, HTTP today does not let me probe the innards of your network ( inside your firewall) just by sending 
a legal but evil payload. If you permit webRTC without ICE, then the browser can be told to fake up UDP packets
and send them to anywhere on your inner LAN. DOS-city.

Tim.