Subject: Re: [Ice] Kathleen Moriarty's No Objection on charter-ietf-ice-00-03: (with COMMENT)

From: "Pal Martinsen (palmarti)" <[email-masked]>
Date: Thu, 1 Oct 2015 08:02:35 +0000

> On 01 Oct 2015, at 05:23, Ben Campbell <[email-masked]> wrote:
> 
> On 30 Sep 2015, at 18:58, Kathleen Moriarty wrote:
> 
>> ----------------------------------------------------------------------
>> COMMENT:
>> ----------------------------------------------------------------------
>> 
>> The charter is fine as-is, but I would have expected some mention of
>> security as the referenced RFC goes into detail about a number of
>> possible attacks.  I put this down as no objection since much of the
>> solution will rely on the protocol this is used for - WebRTC or SIP in
>> the case of the referenced RFC.  As long as security is addressed in
>> drafts produced, maybe mention isn't needed in the charter.
> 
> Hi Kathleen,
> 

> IMO, RFC 5245, and related drafts, have historically addressed security in some depth. I don't expect anything in this charter is likely to change that. We could add some text about security, but I think it would fall into the "all WGs need to address security” sort of thing.
> 

The recent “dissident exposure” discussion that happened in rtcweb regarding how the application collects IP addresses on all available network interfaces is certainly something the ICE WG could help other users of ICE understand. It would be nice to not make the same “mistake” twice. 

I agree with Ben that security and privacy issues is mandatory to implement in any draft.

.-.
Pål-Erik

> Is there something specific you had in mind?
> 
> Thanks!
> 
> Ben.
> 
> _______________________________________________
> Ice mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ice