Re: [rtcweb] On the topic of MTI video codecs

[Daniel-Constantin Mierla <[e-mail]>]

On 10/31/13 10:27 PM, Eric Rescorla wrote:
>
>
>
> On Thu, Oct 31, 2013 at 2:08 PM, Daniel-Constantin Mierla 
> <[e-mail] <mailto:[e-mail]>> wrote:
>
>
>     On 10/31/13 4:10 PM, Olle E. Johansson wrote:
>
>         On 31 Oct 2013, at 10:02, Neil Stratford <[e-mail]
>         <mailto:[e-mail]>> wrote:
>
>             On 30 Oct 2013, at 17:55, Adam Roach <[e-mail]
>             <mailto:[e-mail]>> wrote:
>
>                 As Jonathan mentioned earlier, this morning Cisco
>                 announced that it will be open sourcing an H.264
>                 implementation as well as gratis binary modules
>                 compiled from that source and hosted by Cisco for
>                 download. Mozilla will be modifying Firefox to support
>                 H.264 by downloading Cisco's binary module.
>
>
>             It seems like most of the groundwork is being done here
>             for a real codec plugin API which would obviate the need
>             for any particular codec to be selected as MTI.
>
>             Can we encourage this new codec plugin API to be developed
>             in an open way as part of the standards process and
>             therefore be supported in all browsers? (Enabling for
>             example the addition of VP8 to a browser that may not
>             natively ship with it.)
>
>         I don't agree. The idea was to create a realtime web platform
>         without the need for any plugins or downloadable modules.
>         We've had that for ages and it is not a good solution.
>
>         I am still for a MTI codec or set of codecs so we always can
>         set up video calls, regardless of implementation and if it's
>         possible to download by policy or network conditions a
>         specific binary.
>
>     Downloading a binary opens doors for tons of risks, knowing that
>     lot of carriers do caching or interpose themselves (e.g., it
>     happens very commonly for dns to redirect you to some adds page
>     when typing an invalid domain), thus is easy to replace the
>     original source, so a rather complex security mechanism has to be
>     put in place.
>
>
> Solely on the security question...
>
> I'm not sure what you mean by "rather complex". What I would expect is 
> to have signed
> binaries. This addresses the question of attack from the network and 
> is how we
> intend to handle things in Firefox.
>
> Note that any product that auto-updates (like Firefox and Chrome) 
> already need
> to have some mechanism for verifying that the things they download are 
> correct.

Typically the updates you mentioned are done from the project's sites, 
so that is easier to handle. Now there is a third party involved, 
requiring some sync'ing between Cisco and browser's sites. It's like a 
menage-a-trios, pretty dirty affair. I wonder why flash plugin was not 
loaded this way, it was always free -- but had to be 
downloaded/installed explicitly by users.

>
>
>     Even the argument that the code can be compiled and signatures
>     compared is not really feasible - simply it cannot be done by
>     mobile devices - they don't have the sdk installed.
>
>
> I don't see why this would be needed. The containing program (e.g., the
> browser) doesn't compile, it just does signature verification.
>
> Obviously, this only addresses the question of attack from the network,
> not malicious binaries constructed by Cisco. I expect that to be addressed
> by third parties doing verified builds and comparing the binaries. 
> Presumably,
> one could invent some countersignature mechanism to allow clients to
> verify that a specific third party had verified a build.
If we get to 'one could invent some ...' and wait for that, better wait 
for a pure open source video codec. Mozilla is working in that direction 
anyhow.

Daniel

-- 
Daniel-Constantin Mierla - http://www.asipto.com
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda
Kamailio Advanced Trainings - Berlin, Nov 25-28
   - more details about Kamailio trainings at http://www.asipto.com -