Re: [rtcweb] Consensus call regarding media security

[Iñaki Baz Castillo <[e-mail]>]

2012/3/28 Roman Shpount <[e-mail]>:
> My main objection is that if an application developer does not take care to
> develop a secure application, nothing you can do on the standard side will
> make it a secure application. If I am building a public voice blog that
> records a voice message that anybody can listen to on the web site security
> is not needed. My assumption is that a fair number of applications would be
> like this. So for such applications this is an unnecessary feature.

In all those scenarios you mention, using security (SRTP) is not *bad*, is it?
The fact that in certain scenarios it could be not needed, it does not
mean that "no security" is better than "security".


> WebRTC will not exist in vacuum. It will communicate with other systems. It
> is not limited to old SIP devices. It can be something new like server side
> speech recognition that is integrated with web application. For such
> application extra code and interop requirements to support security will
> represent a real and significant cost. Any requirement, unless absolutely
> necessary will create barriers to entry for new applications. I would like
> to avoid as many of those as possible.

RFC 3711 was created in 2004, 8 years ago!

Which "new" application you mean if it's not capable of implementing a
simple specification from 2004? how "new" is it? is it really new? or
is it a "SIP voicemail server" made in 2002?


Sorry but I still see *no* argument at all in favour of allowing plain
RTP in WebRTC. And AFAIK there is already consensus about it: plain
RTP is not allowed.


Regards.


-- 
Iñaki Baz Castillo
<[e-mail]>