Re: [rtcweb] Same location media

[Matthew Kaufman <[e-mail]>]

On 10/20/11 9:27 AM, Roman Shpount wrote:
> Changing the topic from "A plea for simplicity, marketability..."
>
> On Thu, Oct 20, 2011 at 11:57 AM, Iñaki Baz Castillo <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>     Also you are asuming that the media is sent to the same IP of the web
>     server (in case a RTCweb scenario does not include user2user calls).
>     This is a too much simplified scenario, and you miss that a DNS A
>     record can point to N IP's, and you also miss the case in which the
>     webserver has an IP different than the media server (regardless they
>     both are located within the same provider infrastucture). The browser
>     cannot determine it by itself, so security is always a need, and IMHO
>     it's a bad idea to allow a very corner case in which such security
>     could be relaxed.
>
>
> I am not missing the DNS issues. I wanted to bring this up in my 
> previous email, but did not want to confuse the issue. I don't 
> advocate for this case at all, I just wanted to clarify that "same 
> origin media" does not necessarily mean two phones in the same 
> location and means media going to the same location as JavaScript 
> origination.
>
> Few additional points related to this:
>
> 1. This is what Flash is doing now for streaming media. It does not 
> need consent to send media to the same server that sent the flash app.

Flash can send media to ANY server that accepts the RTMP or RTMFP 
connection. (And obviously it can attempt to open a connection to any 
address using these protocols.)

The server can then examine headers to determine where the SWF file came 
from, etc.

The "consent" model for Flash is that if you speak RTMP or RTMFP, you 
understand what that is... and neither protocol looks like anything else 
on the wire.

Matthew Kaufman