Spec "disable: webrtc" enforcement about webappsec-permissions-policy

[alvestrand]

This seems to confuse getUserMedia with WebRTC. They are different things.

[alvestrand]

@foolip noted that the discussion is taking place.

[foolip]

Yeah, I remembered seeing "webrtc" as a category and wondering if it made sense, mentioned it to @alvestrand today, didn't know there was an issue already.

I suspect this is too broad a label, can it be removed in favor of the specific things you want to disable? After all, it's possible to use getUserMedia to take photo of yourself without involving WebRTC at all.

[foolip]

I wondered out loud if this issue might have something to do with IP exposure and @alvestrand pointed me to https://tools.ietf.org/html/draft-ietf-rtcweb-ip-handling-01

If preventing iframes from using those APIs was part of the orignal motivation, figuring out what the minimal surface to block is would be good. To just make the RTCPeerConnection() constructor throw might be doing more than you want?

[igrigorik]

@alvestrand @foolip see 97243cf - does it make sense? Please chime on that commit and/or on #33.

[alvestrand]

Sorry for being slow to respond - this looks OK to me. There are other things that might want to go in either category (ORTC new comms features that can be used without PeerConnection, for instance), but let's burn that bridge when we come to it.