IETF Logo Mail Archive

Re: [rtcweb] What is consent?

Martin Thomson <martin.thomson@gmail.com> Wed, 12 September 2012 23:49 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6537E21F861F for <rtcweb@ietfa.amsl.com>; Wed, 12 Sep 2012 16:49:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level:
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zQJOxew61nPi for <rtcweb@ietfa.amsl.com>; Wed, 12 Sep 2012 16:49:42 -0700 (PDT)
Received: from mail-wg0-f44.google.com (mail-wg0-f44.google.com [74.125.82.44]) by ietfa.amsl.com (Postfix) with ESMTP id 6C55021F861C for <rtcweb@ietf.org>; Wed, 12 Sep 2012 16:49:39 -0700 (PDT)
Received: by wgbdr13 with SMTP id dr13so1215403wgb.13 for <rtcweb@ietf.org>; Wed, 12 Sep 2012 16:49:38 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=GIaAZfBqIcTB5UsQ/SDTO741/++Hqnd6JvaN0pWuTVg=; b=e3bizbB/F+oDcNm56KyXr/5i9BSZunOzPfDwN/rDr2BjNIYfePTG7V08X4WMJgen/U 4Tf5CEpCdVaIILA3vEFm4qG5Y8omlueV3SOYynvOCjYMqCDzCDYXg+GY0FbtugA1GjJx xPhPyN0dZ6x1gY4dBuU8nYA2EPmWaW6kUmYg0J2EsDWGtGYqNwCbIM6AuGb5rsY2xBDW d0LW0TA6BREsV0Idk4mXy0L1znlIUB20u2laJtKHJReUwDVT4CT3N4U2su7VZkAYkzN9 /Sc253PgiXOL8Lv6WFzZxwHL55aNCv/GRXlpRxz9xmPkopMloriXktCCw1xgAcS9xLrd z63Q==
MIME-Version: 1.0
Received: by 10.216.140.104 with SMTP id d82mr84807wej.130.1347493778400; Wed, 12 Sep 2012 16:49:38 -0700 (PDT)
Received: by 10.180.96.9 with HTTP; Wed, 12 Sep 2012 16:49:38 -0700 (PDT)
In-Reply-To: <50511D4C.9040805@alvestrand.no>
References: <CABkgnnXAPZ5BN=CUwYdEpHKbCLBxctqpONL==QWf_WwgrNEK_A@mail.gmail.com> <CABcZeBNnoQwJu1MYSW=6q6pkrgXSPSUtVyOsngrPP6b8GaegdQ@mail.gmail.com> <CABkgnnUNhka8OJsiNCV5iOvU_cGyvt_y8=DN6qnud3Xr-dy1iQ@mail.gmail.com> <CABcZeBNddHgHnkZ5b2N4i-np3WuY51f6WHkBdT5mHBsieLMDow@mail.gmail.com> <BLU169-DS48211D4056CB291285DD4393930@phx.gbl> <08c301cd9076$a2405c40$e6c114c0$@com> <BLU401-EAS3820748E547AD9D27E1220893920@phx.gbl> <DA165A8A2929C6429CAB403A76B573A5146A00B9@szxeml534-mbx.china.huawei.com> <BLU401-EAS46055078032CCFBDDFD2C2B93920@phx.gbl> <CABkgnnUMcFx15qytVNo2G67CX84TLZ_29UMB5EzJ=WqRF5o1GQ@mail.gmail.com> <0c2301cd910d$7f4bd150$7de373f0$@com> <CABkgnnUMsoOT954Jgd=jq6jjrhLV0uqSL6R4148mYtFMPG-JaQ@mail.gmail.com> <50511D4C.9040805@alvestrand.no>
Date: Wed, 12 Sep 2012 16:49:38 -0700
Message-ID: <CABkgnnUNNeKfv2-TEh4JAc+P7Au3GeP4n4bjEkr3swF7kx7=Pw@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: Harald Alvestrand <harald@alvestrand.no>
Content-Type: text/plain; charset="UTF-8"
Cc: rtcweb@ietf.org
Subject: Re: [rtcweb] What is consent?
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/rtcweb>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Sep 2012 23:49:43 -0000

On 12 September 2012 16:39, Harald Alvestrand <harald@alvestrand.no> wrote:
> I may be hopelessly naive here, but isn't the b= parameter of the SDP
> negotiation supposed to give an upper limit on how much data the recipient
> expects to receive on a connection?

SDP is completely unauthenticated.  We have to assume that it is
provided by a web attacker.

That doesn't mean that the SDP bandwidth isn't a limit, or that it
shouldn't be respected.  On the other hand, if it's set to 10
bazillion, it doesn't give an RTP sender permission to send that much
data toward a peer.

--Martin

v2.23.0 | Report a Bug | By Email