Re: [irsg] Meetecho for interims?

[Carsten Bormann <[e-mail]>]

Hi Toerless,

I really didn’t want to further extend this part of the thread.
But it seems my position can easily be misunderstood.

> What specifically are the technical risks for which you would not have joined
> a ZVC meeting, such as one of the IETF108 side meetings that used zoom ?
> (or for that matter of course future interims, which this thread is about)

The technical risks, and ZVC’s moves to appear getting them covered, are well documented.  I cited Steven Bellovin’s piece that came to the conclusion that these are manageable for the kinds of communication that are similar to what we do in open meetings.
(I don’t agree with respect to system security.)

However, the reason I’m not going to join conferences based on ZVC products is mainly Ethical, with the technical issues playing second fiddle.

> If the reason is fear of unknown undetected security risk due to lack of
> trust into the security diligence of ZVC, would using the RTCweb browser
> client instead of the native client resolve this issue ?

Certainly not the Ethical issues.  On the technical side, I do believe that I should prefer browser access over installing vendor-supplied apps with wide access to my system.  But, again, see Steve’s counterpoint on this specific issue.

As a general observation, it is enlightening to which level of criminal energy (technical term here, not the legal one) the ZVC developers have risen to circumvent CORS for their backdoor; it does not seem far-fetched to assume there will be other attacks on browser security when the browser security features happen to get in the way of ZVC corporate policy.

> If we want future interims like past interims to be publically announced
> without participant auhentication, i think zoombombing would be a risk
> for any platform we choose: meetecho, webex, zoom, BBB, whatever.

Even discussing Zooombombing as a security issue makes me question whether you have started to consider the real issues.  However, let me point out that conferencing systems based on authorization, such as meetecho or BBB (if correctly configured) only have the problem as far as the authorization can be gamed.

> Leaves as the biggest risk AFAIK the problem of clients creating backdoors,
> and i would hope that w3c/ietf work on browser client platform security
> would be sufficient.

(See above.)

Fool me once, shame on you; fool me twice, shame on me.

Grüße, Carsten