> For one we’re limited to TCP and UDP– without a better protocol for media streaming .
What's wrong with UDP for media? Is it the lack of multicast?
> authentication was omitted , resulting in horrifying UX and security holes
While this is painfully obvious now I don't think the original Internet pioneers have ever really thought of the need for authentication as the ubiquity and threat landscape was very different. Regardless, we're all paying the price now.
that's not quite right. Bellovin et al in the late 80s early 90s really made a big push for authentication infrastructure (SPKI). but at the time PKI was being held hostage by ITAR (I remember sending off to get permission to use the RSA library, and getting something back several months later.
so yes, many of the people working on these things didn't have a security mindset (I had unix accounts at all kinds of random places), but some did...and the US DoD really threw cold water on the whole business
He’s talking about late 80s , early 90s. Go back a few more years. Definitely before HTTP. FTP authentication was optional and I think sent in plain text or some really simple encryption (this is before SFTP). Telnet was used everywhere… plain text. And finger… really?
I don't think most of these things should live at the Transport Layer personally. I am certainly a fan of SCTP but SCTP hasn't yet received widespread middlebox adoption. Unfortunately, the state of IP Media is pretty terrible. SIP/RTP/RTMP are all very complicated and fiddly to get working. The WebRTC stack, which wraps some of these protocols up, is its own beast. XMPP media stacks tend to be IMO the "simplest" and even they are quite complicated.
As someone who's rolled a few custom UDP network stacks I would tend to agree.
UDP is pretty low level(yay MTU discovery) but it gives you most of the tools you need which is why a good number of SCTP implementations are just built on top of it.
What's wrong with UDP for media? Is it the lack of multicast?
> authentication was omitted , resulting in horrifying UX and security holes
While this is painfully obvious now I don't think the original Internet pioneers have ever really thought of the need for authentication as the ubiquity and threat landscape was very different. Regardless, we're all paying the price now.