[rtcweb] Solutions sought for non-ICE RTC calls, not +1 (Re: Requiring ICE for RTC calls)

[Harald Alvestrand <[e-mail]>]

The current assumption is that browsers will get Javascript from 
multiple sources, some of which will be malicious. Malicious sources 
cannot be allowed to initiate sessions without ICE, for all the reasons 
given in the "security" I-D.

Before we can even consider relaxing the ICE requirement, we need to see 
a trust model formulated for who gets to decide, for a particular piece 
of Javascript, if it's allowed to operate within a relaxed trust model.

So far, I have seen no such proposals. Can you who argue for this 
solution please go away and write a draft that describes one, instead of 
repeating "+1" without any new solutions?

On 09/27/2011 08:53 PM, Iñaki Baz Castillo wrote:
> 2011/9/27 Roman Shpount<[e-mail]>:
>> What about intranet applications that would want to locally call existing IP
>> phones within the same enterprise? Should we force them to go through a
>> media gateway as well or should we allow to overwrite this using a policy?
> +1
>