IETF Logo Mail Archive

Re: [rtcweb] draft-schwartz-rtcweb-return

"Hutton, Andrew" <andrew.hutton@unify.com> Thu, 16 April 2015 17:41 UTC

Return-Path: <andrew.hutton@unify.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B5FB1B3383 for <rtcweb@ietfa.amsl.com>; Thu, 16 Apr 2015 10:41:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.61
X-Spam-Level:
X-Spam-Status: No, score=-2.61 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vtUAW_hQ6VWm for <rtcweb@ietfa.amsl.com>; Thu, 16 Apr 2015 10:41:02 -0700 (PDT)
Received: from mx11.unify.com (mx11.unify.com [62.134.46.9]) by ietfa.amsl.com (Postfix) with ESMTP id 8EB901B3377 for <rtcweb@ietf.org>; Thu, 16 Apr 2015 10:41:02 -0700 (PDT)
Received: from MCHP01HTC.global-ad.net (unknown [172.29.42.234]) by mx11.unify.com (Server) with ESMTP id 35B801EB843F; Thu, 16 Apr 2015 19:41:01 +0200 (CEST)
Received: from MCHP04MSX.global-ad.net ([169.254.1.22]) by MCHP01HTC.global-ad.net ([172.29.42.234]) with mapi id 14.03.0224.002; Thu, 16 Apr 2015 19:41:00 +0200
From: "Hutton, Andrew" <andrew.hutton@unify.com>
To: Justin Uberti <juberti@google.com>, "Cullen Jennings (fluffy)" <fluffy@cisco.com>, "rtcweb@ietf.org" <rtcweb@ietf.org>
Thread-Topic: [rtcweb] draft-schwartz-rtcweb-return
Thread-Index: AQHQdlnUVAWuNux41UeqAkJvjqNVyZ1P69NA
Date: Thu, 16 Apr 2015 17:41:00 +0000
Message-ID: <9F33F40F6F2CD847824537F3C4E37DDF1E734E46@MCHP04MSX.global-ad.net>
References: <9DA8307B-263C-4951-A55C-36B42D27C08B@cisco.com> <6042868B-57EB-4C5A-B93E-C58D846E14E4@cisco.com> <CAOJ7v-1aiVKRbx1iePvT8egE6SNxgPvddGoni3S+G=axV1zcQA@mail.gmail.com>
In-Reply-To: <CAOJ7v-1aiVKRbx1iePvT8egE6SNxgPvddGoni3S+G=axV1zcQA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [172.29.42.225]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/rtcweb/jkXpUWBAmx0nVL1cg6Un8qIs2J8>
Subject: Re: [rtcweb] draft-schwartz-rtcweb-return
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/rtcweb/>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Apr 2015 17:41:04 -0000

+1 I also think this looks like a sensible revision and would like to see this adopted sooner rather than later.

Andy



> -----Original Message-----
> From: rtcweb [mailto:rtcweb-bounces@ietf.org] On Behalf Of Justin
> Uberti
> Sent: 14 April 2015 03:22
> To: Cullen Jennings (fluffy)
> Cc: rtcweb@ietf.org
> Subject: Re: [rtcweb] draft-schwartz-rtcweb-return
> 
> I think this is a sensible change and we should adopt the revised
> document.
> 
> On Tue, Apr 7, 2015 at 5:58 PM, Cullen Jennings (fluffy)
> <fluffy@cisco.com> wrote:
> 
> > On Mar 26, 2015, at 9:20 AM, Cullen Jennings <fluffy@cisco.com>
> wrote:
> >
> > I'd like to point out that the combination of ietf-tram-turn-server-
> discovery and draft-schwartz-rtcweb-return allow any network you are
> connected to more or less MITM your media and do things like rate limit
> it, generate analytics on who you are talking to, force your traffic
> through an intermediary that is in a  different legal jurisdiction and
> so on.
> 
> We discussed this after the meeting and came up with a  way to resolve
> this concern. Benjamin has added some text to the -06 to that
> specifically addresses this issue
> 
> http://www.ietf.org/rfcdiff?url1=draft-schwartz-rtcweb-return-
> 05&url2=draft-schwartz-rtcweb-return-06
> 
> This completely deals with the issue I raised and with that change I
> support adopting this as a WG document.
> 
> After adoption, I think the WG should consider if any text is needed
> around the issue of TURN credentials. (If you run TURN with no
> credentials and an attacker can spoof the IP address in UDP packets,
> you can end up with the TURN servers in a nasty forwarding loop that
> allows an huge amplification factor for an attacker trying do DOS the
> turn servers - this is still possible with authentication but you know
> who to blame. When TURN was first done with was one of the reason TURN
> requires auth and STUN does not). However, I believe this issue can
> solved and should not block adopting the draft. )
> 
> Cullen
> 
> 
> 
> 
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb

v2.23.0 | Report a Bug | By Email