Re: Use of getDefaultIceServers

On 01/25/2019 04:18 PM, Henrik Boström wrote:
> I'm still not convinced that this is within the scope of what we
> should be doing. Are we encouraging users to go into browser settings
> in order to make full use of a website? Are we encouraging users to
> pass down special flags to their browser? Why are we solving the issue
> on this layer, why is it not up to the application where to connect to?
>
> In other contexts you would sign in to the website, enter some code or
> configure settings in the website. Or if you want things to "just work
> for anybody clicking the link", why not save the configuration
> server-side and get configuration-specific URLs?
> foo.com/bar-enterprise <http://foo.com/bar-enterprise> or
> bar-enterprise.foo.com <http://bar-enterprise.foo.com>.

One of the scenarios is that of an user at IBM callling into a
conference hosted by Google on a Cisco conference engine.
The configuration needed is specific to IBM's network, and neither Cisco
nor Google has any idea what that configuration may be, or even if it's
the same configuration as yesterday. (Replace IBM, Google and Cisco with
any names you want to. I'm just using some familiar ones.)

Who would get that information from IBM's network administratior to the
server-side configuration, and whose URL would it be stored under?

In the getDefaultIceServers proposal, the IBM network administrator can
configure the user's browser through normal Chrome admin tools, the
Cisco application could read the configuration using
getDefaultIceServers, and the Google host wouldn't have to care about
anything at all.

Note: I'm not that sure the extension is worth implementing, but I don't
want to spend time discussing alternate proposals where I don't see how
to make them work.

Harald
>
> On Wed, Jan 23, 2019 at 10:43 PM Harald Alvestrand
> <harald@alvestrand.no <mailto:harald@alvestrand.no>> wrote:
>
>     Den 23.01.2019 19:15, skrev Cullen Jennings (fluffy):
>     >
>     > So just wanted to put on list a few key things about this
>     >
>     > 1) the goal here is to allow an app to discover a local TURN
>     server run by enterprises that allows connectivity through the
>     firewall
>     >
>     > 2) the app has no prior relation with the enterprise so it is
>     not like every enterprise can go and configure the address of
>     their TURN server for every WebRTC app that might use this. That
>     would be fine for the huge apps like WebEX but it is a very huge
>     barrier of entry for smaller new apps. That’s not the way to grow
>     an ecosystem.
>     >
>     > How I see this is working is:
>     >
>     > a) The TURN server(s) are configured into the browser via an non
>     specified way. It could be how HTTP proxy gets configured, it
>     could just be the disk, it could have a UI too.
>
>     For Chrome, the natural thing to do would be to include an item in the
>     org console - probably settable via chrome://flags, but the site admin
>     could set the flag for every Chrome browser run by a registered
>     user in
>     his domain.
>
>     >
>     > b) If the TURN server is usable from the point in the network,
>     the browser reports it in the getDefaultIceServers function
>     >
>     > c) if the apps wants to use it, it passes it back as the browser
>     as one of the TURN servers to use
>     >
>     > We can brainstorm solutions to this but in the past, we did that
>     and came to this. The problem was no good way to all a JS app to
>     auto discover things about the local network. I do think there are
>     many ways to skin this cat and I’m not married to any particular one.
>     >
>     > An alternative solution was that the browser always use the
>     configured TURN servers and ignore the JS provided ones. This does
>     not work for apps where the app requires a particular TURN server.
>     The TURN server may be embedded into a conference server and you
>     have to use that one on. Or the TURN server may be the way gets in
>     and out of the data center. For whatever reason, some apps only
>     work with their turn servers. I could live without this but when
>     we talked about it before, there seemed to be people that were not
>     happy with the browser changing the TURN servers without
>     interaction with the app.
>     >
>     > This does add to the fingerprint info - maybe. If the the
>     browser only reports it when it is reachable, then it only gets
>     reported when the browser is inside an enterprise that runs a TURN
>     server. However, the IP address block of the HTTP requests
>     probably reveals the same info in just about ever use case so it’s
>     not clear this does increase the fingerprint. However, this is
>     well worth more discussion.
>     >
>     > Cisco would like to see this functionality and has said so many
>     time in the past. We are not the only people that have. It is
>     pretty easy to implement in browsers. It may not matter much for
>     apps not used in enterprises. But if web apps fail in an
>     enterprise, then one needs to develop mobile and desktop apps
>     which remove the need to do a web app.
>
>     As to Youenn's suggestion of hiding the exact list - we have added
>     APIs
>     and stats that return the URL of the TURN/STUN servers used. So either
>     we prevent debugging of issues with bad server configs, or we accept
>     that the list of STUN/TURN servers will be revealed (which is
>     perfectly
>     sensible when there are no "hidden" servers - the app already knows.)
>

-- 
Surveillance is pervasive. Go Dark.