Re: [rtcweb] Solutions sought for non-ICE RTC calls, not +1 (Re: Requiring ICE for RTC calls)

[Eric Rescorla <[e-mail]>]

On Tue, Sep 27, 2011 at 3:13 PM, Roman Shpount <[e-mail]> wrote:

> Eric,
>
> I would suggest we should have an ability to disable ICE/SRTP in browser
> settings altogether for debugging purposes and have an ability to add a web
> site to browser settings (or assign it to intranet zone), which would enable
> this web site to setup calls without ICE/SRTP. This way a developer can
> disable these protocols to test things, and user can take an action to say
> that it trust a certain web site and allows it to place calls anywhere. I
> would think browser settings are outside of the standards document, but we
> at least should have requirements for ICE-required and SRTP as SHOULD, not
> MUST.
>

It's really a mistake to conflate ICE and SRTP here. If the user opets not
to use SRTP,
he's primarily hurting himself. If he opts not to use ICE, he's potentially
allowing his
browser to be used as an attack platform. These are not the same thing.

As for what's convenient for developers... I'm a developer, and while it
might be useful
to allow a setting to disable ICE and/or SRTP, that doesn't mean I need to
expose that
setting to the user. I really don't understand the virtue of a user-visible
setting to
disable the ICE requirement.

-Ekr