Re: [tram] Stephen Farrell's Discuss on draft-ietf-tram-turn-third-party-authz-15: (with DISCUSS and COMMENT)

[Oleg Moskalenko <[e-mail]>]

On Thu, Apr 30, 2015 at 12:47 AM, Stephen Farrell
<[e-mail]> wrote:
>
>
> On 30/04/15 02:02, Oleg Moskalenko wrote:
>>
>> different implementations of what ? TURN Servers do not have to
>> interact with each other. The interactions are between WebRTC server
>> and TURN servers.
>
> Clearly.
>
>> I see it as perfectly OK if different TURN servers
>> access different WebRTC servers in a different manner.
>
> That is not the same as picking a mandatory to implement method,
> which is what I'm arguing for.

I am against a mandatory method - because that topic has nothing to do
with STUN and TURN functionality. The implementation method sections
must be just an examples. There may be million different ways to
exchange the keys between WebRTC and the TURN server.

>
>> This WG is
>> about STUN and TURN; I do not think that we have to deal with WebRTC
>> servers standardization. I believe that the document addresses the
>> TURN server operations standard in a proper way, and leaves the
>> question of WebRTC to their WG.
>>
>> How the TURN server stores the credentials, amd how those credentials
>> are getting filled in the database, is not the topic of this WG, I
>> believe.
>
> We disagree then. ISTM that either everyone will implement 4.1.1 or
> else this specification will produce interop failures or go unused
> when the probability that a WebRTC server and TURN server share a key
> is not sufficiently high for people to bother turning this on. (And
> yes, that's as fallible prediction as most people's:-)

Yes, we disagree. With your proposal, you will achieve exactly
opposite from what you are declaring.

WebRTC server and TURN server are modular servers. They have different
semi-independent parts. The essential parts functionality is dictated
by the corresponding standards. There is absolutely no necessity to
mandate one way or another in the key exchange parts. In reality, as
it is usually deployed, the same people are controlling both servers.
They may decide how they want to implement the key exchange. Today,
they can take off-the-shelf parts for WebRTC and TURN servers, and
then they can write a set of simple scripts for the key
replication/exchange/etc. If there will be a mandatory method, I
predict that there will be less available parts and less supply of the
necessary parts for the deployment.

Overall, I do not think that any TURN standard has to be containing
the exact HTTP/HTTPS details, protocols and APIs. Those are just
foreign particles and they can be easily left out of scope.