Subject: [tram] Kathleen Moriarty's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS)

From: "Kathleen Moriarty" <[email-masked]>
Date: Mon, 29 Aug 2016 06:49:57 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-tram-turn-server-discovery-09: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discovery/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

This should be easy to resolve.  In reading the draft, it doesn't cover
any mechanism for the TURN server to limit what clients can discover it. 
For the second and third method, it seems like there are possible ways to
do this.  Could these be added to the security considerations?  You'd
need to state that this isn't possible with the first method.  If there
is a reason why it is always okay to discover a TURN server, please let
me know why this is not appropriate to add.  Thanks.

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Wed, 31 Aug 2016 07:02:43 +0000

> -----Original Message-----
> From: Kathleen Moriarty [mailto:[email-masked]]
> Sent: Monday, August 29, 2016 7:20 PM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; Simon Perreault
> <[email-masked]>; [email-masked]; [email-masked];
> [email-masked]
> Subject: Kathleen Moriarty's Discuss on draft-ietf-tram-turn-server-discovery-
> 09: (with DISCUSS)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> This should be easy to resolve.  In reading the draft, it doesn't cover any
> mechanism for the TURN server to limit what clients can discover it.
> For the second and third method, it seems like there are possible ways to do
> this.  Could these be added to the security considerations?  You'd need to
> state that this isn't possible with the first method.  If there is a reason why it is
> always okay to discover a TURN server, please let me know why this is not
> appropriate to add.  Thanks.

I don't see a reason why TURN server discovery should be restricted only to specific clients. Please explain the scenarios for imposing such restrictions.

Cheers,
-Tiru