Re: [rtcweb] URI schemes for TURN and STUN

On Oct 29, 2011, at 15:11 , Harald Alvestrand wrote:

> Hi,
> being in the process of scanning all the drafts with -rtcweb- in them, I came across these two:
> 
> draft-nandakumar-rtcweb-stun-uri-00.txt
> draft-nandakumar-rtcweb-turn-uri-00.txt
> 
> Just three comments:
> 
> - I think it's not RTCWEB business. They should be pointed at the home group for STUN/ICE.

I suspect the point of putting rtcweb in the name was so this group of people would find them. I doubt you would have noticed them had they been named behave. That said, I did ask the authors to send emails about them to the behave WG. So I get your point,  but I think they were meant for this group to read. I know I would not have noticed them had they been in behave. 

> - I do not think it's appropriate to use "turn" and "turns" for indicating transport. Polluting the URI namespace with more configuration parameters in the form of trailing "s" is a Bad Thing.

It's a bit more complicated than that - some time this is the right thing, sometimes not. I have no idea of the case here but just saying HTTPS was a Bad Thing seems a bit over simplistic. Anyways - I'd have to think about what we need to accomplish, what the use cases are and try to sort this out. I'm not arguing for or against turns - I'd want to see a bit more info before getting into that. 

> - Passing passwords in URIs is generally a Bad Practice. If you really want this in this case, please explore the implications thereof fully in the Security Considerations section.

Agree it is not good. Questions is, is it any worse than passing them JS downloaded over HTTP or HTTPS? I note that is is what another document I am co-author of is suggesting so I'm a bit sensitive about how that conversation goes. I don't have real strong feeling about if it should be in the TURN URI or not but I have pretty strong feelings that it is either going to be in the URI or sitting in the same HTTP doc right beside the URI with all the same "Bad Practice" issues either way. 

> 
> Good luck with the discussion (elsewhere)!

> 
>                 Harald
> 
> 
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb