[rtcweb] Secdir last call review of draft-ietf-rtcweb-jsep-23

[Phillip Hallam-Baker <[e-mail]>]

Reviewer: Phillip Hallam-Baker
Review result: Ready

Given the design constraints in which the protocol operates, it is hard to see
how this could be done differently.

I have two sets of security concerns. One is that implementations need to be
designed so as to avoid buffer overrun conditions and also to prevent such
conditions leading to a breach. Compression formats such as are inevitably used
in video and image applications tend to make promiscuous use of nested length
encoding formats that commonly lead to security vulnerabilities.

This document does not have such a warning, having a reference on most of the
security issues, a warning on this issue should appear in:
https://tools.ietf.org/html/draft-ietf-rtcweb-security-08

The other security concern is that giving control over the host browser to run
pretty much arbitrary code was always going to be a security disaster but there
isn't much that can be done at this point.