3 ms·
As someone who has to troubleshoot telephony applications, mandatory encryption makes troubleshooting much harder. As someone who runs applications on private,
by Aloha 7y ago
As someone who has to troubleshoot telephony applications, mandatory encryption makes troubleshooting much harder. As someone who runs applications on private, isolated networks, mandatory encryption just adds more overhead for me without much benefit.
- ikiris 7y agoDinosaurs said the same thing about HTTP and Telnet. You have a point, but its flat out wrong
- iso1210 7y agohttps does make troubleshooting harder. So does SSH.
- coretx 7y ago'If you can't stand the heat, get out of the kitchen'
- iso1210 7y agoI didn't say encrpytion was bad But for an isolated use case where you control both ends and the network itself, it's entirely valid to say that it's overhead with little benefit. Personally I think the benefits of using encrpytion by default outweigh the downsides, but I can see others may disagree, I wouldn't call them "flat out wrong".
- yjftsjthsd-h 7y agoOn the one hand, I would like a debug mode that let me run without encryption. On the other hand, I agree that if it's not required then it will end up being skipped out on in a real, production system on the public internet.
- Aloha 7y agoI disagree that encrypting the header data for SIP to be all that critical, even on the public internet, the RTP yeah, thats a good thing to encrypt, but headers? nah - its good if you can, but when you're tryin to bring up two systems with no real user interface to troubleshoot, often the headers data is the most useful thing you have.
- yjftsjthsd-h 7y agoIt might be less sensitive, but isn't there still metadata in there? Or signaling information that would let an (MITM) attacker downgrade the RTP connection?
- Aloha 7y agoI dont know enough about SRTP negotiation to know if a downgrade attack is possible, but I can see ways in a new system to deal with that though.