Re: [rtcweb] Let's define the purpose of WebRTC

[Hadriel Kaplan <[e-mail]>]

On Nov 10, 2011, at 4:34 PM, Eric Rescorla wrote:

> This isn't my point: Roman offered a set of use cases he claimed didn't
> require confidentiality. But in fact, many such cases do. The fact that
> there are also overlapping cases which do not is an argument for erring
> on the side of confidentiality, not the other way around.

But the argument isn't about a generic "game-app" or generic "greeting card" WebRTC use-case - it's about a specific "game-app" or "greeting card" application instance.  In other words, of course for a "game-app" use-case we can imagine games which involve money that need media security; but there are "Farmville" and Scrabble and so on games as well, and those are the specific applications that're being proposed don't need it and may not want it.  Likewise, of course there could be greeting-card application sites that purport to provide strong privacy, but there are free ones that do not claim that today.

The subtle difference, I think, is that you're viewing it like WebRTC is a generic application that can be used by different hosting sites for different purposes, whereas I view WebRTC as a toolkit to build different applications - like a library included with my OS or compiler.  So saying "well since someone could use WebRTC for something sensitive we have to assume the worst case" sounds rather odd to me - it's like a compiler removing a library because some programs made for sensitive data could be accidentally using it.  No?

-hadriel
p.s. it's hard to convey emotion/emphasis/conviction in email, so I'd like to mention I'd also be ok with SRTP being mandatory-to-use.  I just think the arguments used so far for doing so have been weak. ;)  
Personally I think a better argument for making it mandatory-to-use is public/press perception. (and no I'm not joking)