Re: [rtcweb] Resolving RTP/SDES question in Paris

[Hadriel Kaplan <[e-mail]>]

On Mar 23, 2012, at 1:45 PM, Roman Shpount wrote:

Personally, if I were running such an org, and I don't know if it's possible, but I'd go get some form of rootkit/kernel-mod to intercept audio/video/keystrokes well below the user layer, so that you wouldn't have to worry what application was running - just intercept the audio/screen/keyboard somewhere near the drivers.  Presumably some companies make such things, for just such organizations? (sort of like the equivalent of CarrierIQ)  That way it doesn't matter whether it's WebRTC, Flash, or native apps.


Unfortunately this does not always work. What you are looking for is a way to enforceme that all the devices on the organizational network either confirms to organization communication policy or not allowed to communicate. This also applies to other devices that are being brought to your organization (ie lawyer laptop in prison). Organization cannot force everybody to install a key logger to their computers that they bring in, but they can force all the communications coming from within the organization to go through some sort of proxy or not to be allowed to communicate.

But that *is* their policy, and it *is* being followed: as you said, their policy is "all the devices on the organizational network either confirms to organization communication policy or not allowed to communicate".  That is being followed, because all web communications go through the Organization's proxy, and if a lawyer comes in his/her web traffic goes through the proxy…  but the lawyer can't use it for WebRTC-created media - which is exactly matching the Organization's policy, because the lawyer's laptop must not and will not work for WebRTC communications.

I'm not trying to be pedantic or difficult here, or trying to dismiss the use-case.  I know there are many such "super-tight" networks, but I just don't see how we can reasonably accommodate their use-case in this WG.  And I'm pointing out that we really are following their policies, inasmuch as WebRTC media will fail to escape their network - I would be far more worried if we somehow bypassed their policies instead.  At least this way it's similar behavior they get for unknown/unauthorized applications, which is arguably what going to random websites and running downloaded javascript is equivalent to.

-hadriel