Re: [rtcweb] URI schemes for TURN and STUN

[Marc Petit-Huguenin <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/01/2011 01:44 PM, Harald Alvestrand wrote:
> Top-posting a general principle, detailed comment at the bottom....
> 
> For all URI schemes, I think the URI needs to contain all the information you
> need in order to make contact with the service; you can't negotiate until you've
> made contact.
> (the process may involve things like "resolve through a resolution mechanism
> like DNS" or "get authorization tokens from somewhere else").
> 
> In the case of TURN, you need to distinguish between TCP, UDP and TLS, and you
> need to make that determination before you send the first packet. That means the
> distinguishing information between those three things belongs in the URL; I
> don't think the scheme is a good place to encode it.
> 
> On 10/31/2011 11:37 PM, "Martin J. Dürst" wrote:
>>
>>
>> On 2011/11/01 0:33, Keith Moore wrote:
>>>
>>> On Oct 31, 2011, at 10:57 AM, Marc Petit-Huguenin wrote:
>>>
>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>> Hash: SHA1
>>>>
>>>> Hi Martin,
>>>>
>>>> So I understand Roy's email as saying in fact the opposite of what Harald said,
>>>> i.e. that using an "s" suffix to signify security is a good thing.
>>>>
>>>> What is your opinion on defining a generic scheme suffix (i.e. "+s" or "+sec")
>>>> that would indicate a well defined set of security properties that could apply
>>>> to any scheme, (vs the current "s" suffix where security properties has to be
>>>> defined scheme by scheme)?
>>>
>>>
>>> There is no "well defined set of security properties that could apply to any
>>> scheme".   Security properties necessarily vary depending on the way a
>>> resource is used, the threat model, and so forth.
>>
>> Here I agree with Keith.
>>
>>> Also, the idea that there should be a "secure" bit in a URI scheme, to
>>> distinguish it from the "insecure" form of a URL, doesn't make much sense. 
>>> You always want to use the best security that's available.
>>
>> You always want the best security you're willing to pay for.
>>
>>> You don't want that to depend on the URI scheme.
>>
>> Ideally not, but in actual operation, it made a lot of sense for HTTP as Roy
>> has explained.
> I think it made a lot of sense because the port 443 convention meant that you
> had to know whether or not to use SSL had to be known before you sent the SYN
> packet.
> 

Well, same thing for TURN, as a different default port is used when TLS is used
(3478 for TURN over UDP and TCP, and 5349 for TURN over TLS).

- -- 
Marc Petit-Huguenin
Personal email: [e-mail]
Professional email: [e-mail]
Blog: http://blog.marc.petit-huguenin.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk6wW48ACgkQ9RoMZyVa61fPKQCfTLUElFx97Pz8XwQHwkJmJNCh
kiEAn3Ew6/LOxc816VpuMWk5hFfKzi5y
=c0vN
-----END PGP SIGNATURE-----