Re: Use of getDefaultIceServers

I'm still not convinced that this is within the scope of what we should be
doing. Are we encouraging users to go into browser settings in order to
make full use of a website? Are we encouraging users to pass down special
flags to their browser? Why are we solving the issue on this layer, why is
it not up to the application where to connect to?

In other contexts you would sign in to the website, enter some code or
configure settings in the website. Or if you want things to "just work for
anybody clicking the link", why not save the configuration server-side and
get configuration-specific URLs? foo.com/bar-enterprise or
bar-enterprise.foo.com.

On Wed, Jan 23, 2019 at 10:43 PM Harald Alvestrand <harald@alvestrand.no>
wrote:

> Den 23.01.2019 19:15, skrev Cullen Jennings (fluffy):
> >
> > So just wanted to put on list a few key things about this
> >
> > 1) the goal here is to allow an app to discover a local TURN server run
> by enterprises that allows connectivity through the firewall
> >
> > 2) the app has no prior relation with the enterprise so it is not like
> every enterprise can go and configure the address of their TURN server for
> every WebRTC app that might use this. That would be fine for the huge apps
> like WebEX but it is a very huge barrier of entry for smaller new apps.
> That’s not the way to grow an ecosystem.
> >
> > How I see this is working is:
> >
> > a) The TURN server(s) are configured into the browser via an non
> specified way. It could be how HTTP proxy gets configured, it could just be
> the disk, it could have a UI too.
>
> For Chrome, the natural thing to do would be to include an item in the
> org console - probably settable via chrome://flags, but the site admin
> could set the flag for every Chrome browser run by a registered user in
> his domain.
>
> >
> > b) If the TURN server is usable from the point in the network, the
> browser reports it in the getDefaultIceServers function
> >
> > c) if the apps wants to use it, it passes it back as the browser as one
> of the TURN servers to use
> >
> > We can brainstorm solutions to this but in the past, we did that and
> came to this. The problem was no good way to all a JS app to auto discover
> things about the local network. I do think there are many ways to skin this
> cat and I’m not married to any particular one.
> >
> > An alternative solution was that the browser always use the configured
> TURN servers and ignore the JS provided ones. This does not work for apps
> where the app requires a particular TURN server. The TURN server may be
> embedded into a conference server and you have to use that one on. Or the
> TURN server may be the way gets in and out of the data center. For whatever
> reason, some apps only work with their turn servers. I could live without
> this but when we talked about it before, there seemed to be people that
> were not happy with the browser changing the TURN servers without
> interaction with the app.
> >
> > This does add to the fingerprint info - maybe. If the the browser only
> reports it when it is reachable, then it only gets reported when the
> browser is inside an enterprise that runs a TURN server. However, the IP
> address block of the HTTP requests probably reveals the same info in just
> about ever use case so it’s not clear this does increase the fingerprint.
> However, this is well worth more discussion.
> >
> > Cisco would like to see this functionality and has said so many time in
> the past. We are not the only people that have. It is pretty easy to
> implement in browsers. It may not matter much for apps not used in
> enterprises. But if web apps fail in an enterprise, then one needs to
> develop mobile and desktop apps which remove the need to do a web app.
>
> As to Youenn's suggestion of hiding the exact list - we have added APIs
> and stats that return the URL of the TURN/STUN servers used. So either
> we prevent debugging of issues with bad server configs, or we accept
> that the list of STUN/TURN servers will be revealed (which is perfectly
> sensible when there are no "hidden" servers - the app already knows.)
>
>