Re: [tram] Alissa Cooper's Discuss on draft-ietf-tram-stun-origin-05: (with DISCUSS)

Thanks, Spencer.  I think this is a very good path forward. I will join
next week's call.

- Alan -

On Thu, May 14, 2015 at 10:55 AM, Spencer Dawkins at IETF <
spencerdawkins.ietf@gmail.com> wrote:

> Dear TRAMsters,
>
> Thanks to everyone who has helped with IESG evaluation for this draft so
> far.
>
> We had a nice conversation on today's formal telechat about this document,
> and I summarized the state of play as
>
> --- BEGIN
>
> Barry's Discuss has been resolved
>
> Ben's Discuss has been resolved
>
> Benoit forwarded the OPSDIR review that hadn't gotten where it needed to
> go, and it will be handled
>
> The Gen-ART review will be handled
>
> Stephen's Discuss had a few parts
>
> - what "analytics" are we talking about here? I think the answer was "for
> network operation and debugging". This was also in Alissa's Discuss, but
> she was OK with adding text to explain that. Origin was intended to be the
> equivalent of Host in HTTP, and the analytic impact is no worse than one IP
> address per realm, which is what's used today.
>
> - this also touched on "MUST NOT send Origin if it's privacy-sensitive,
> but Stephen didn't think that was the right answer
>
> - Stephen also asked why Origin and third-party-auth were both needed. The
> answer was that SIP would require a lot of changes to use third-party-auth.
>
> Alissa's Discuss had a few parts, and Stephen included a couple of
> additional questions in her ballot thread.
>
> - what kinds of things needed to be logged, and what the privacy
> implications were
>
> - whether unauthenticated requests could be twiddled with. The answer is
> that they can be, so you should require authentication if you care.
>
> - Stephen included a question about unique usernames across realms
>
> - Stephen included a question about a client with a username in more than
> one realm  playing games with which username it submits to avoid charging.
> I thought the answer was that anyone charging would be doing it off either
> signaling or media and not off STUN, but Simon corrected me that charging
> for operators who only provide TURN servers would be in scope, so it's
> still an open question. This was also in Stephen's Discuss thread, on
> "lying",
>
> - Stephen included a question about user-memorable usernames being
> long-lived, and tied to an identity. The answer was that this is not true
> for RTCWeb, but was true for SIP.
>
> --- END
>
> After chatting on the call, here's what I think needs to happen.
>
> There are relatively minor comments and questions, most of which have been
> answered, but there are a couple of large and more intertwined questions
> that the IESG needs help with, especially in understanding the relationship
> between Origin and third-party-authz, and how long-lived usernames (in SIP)
> versus short-lived or even ephemeral usernames (which are possible in
> RTCWeb) work in the same protocol mechanism.
>
> The IESG has regularly-scheduled "informal telechats" every two weeks, to
> work through questions like this. It would be helpful for Simon (as
> document shepherd) and any authors who should participate to attend one, so
> we can work through the high-order questions.
>
> The next informal telechat is next week, May 21, at 10 AM EDT. The
> coordinates are
>
>
> https://workgreen.webex.com/workgreen/j.php?MTID=m305722fec48b24d34908d4074b6f0bbe
> Meeting number: 826 345 248
> Meeting password: 1234
>
> If you'd like to take the opportunity to have that conversation, please
> let me know, and I'll add draft-ietf-tram-stun-origin to the agenda.
>
> Thanks for all your work to date, and we'll get through the questions.
>
> Spencer
>
> _______________________________________________
> tram mailing list
> tram@ietf.org
> https://www.ietf.org/mailman/listinfo/tram
>
>