News for hackers. Stuff that matters.
Re:VPN leaks users’ IPs via WebRTC by blattimwind on Wednesday March 28, 2018 @03:18PM (#16700913)
TBH just from setting up one (1) PBX with about half a dozen devices from only two manufacturers -- I would never take a job anywhere near anything having something todo with SIP, ever.
Re:VPN leaks users’ IPs via WebRTC by Aloha on Wednesday March 28, 2018 @03:22PM (#16700958)
SIP is one of a few protocols where two completely standard-compliant implementations are commonly unable to interop.
Re:VPN leaks users’ IPs via WebRTC by MichaelGG on Wednesday March 28, 2018 @06:25PM (#16702593)
Oh it gets better. I have implemented SIP software (written, from scratch). On the SIP implementors mailing list, one of the authors defends the insane parsing rules by saying that C and Java allow you to be flexible with syntax, so why not SIP?

They are totally detached from actually implementing elegant or high performance software. Actual engineers achieve this despite of SIP's terrible decisions. Granted, many of those are inherited from HTTP. Tell me how many HTTP stacks handle comments and line folding properly...

It opens up security holes, too. One proxy interprets \r\r\n as 1 line break, another as 2 line breaks and start of body. Oops, now you can end up sending fun headers to your target because they try to be flexible in accepting input.

IIRC there is essentially no way to implement SIP standardly because of so many broken implementations. You have to make some decisions on certain parsing that will break one but any other way will break another.

Text-based protocols invite abuse by designers and implementors alike. IETF compounds these by living in a fantasy world.

Re:VPN leaks users’ IPs via WebRTC by Aloha on Wednesday March 28, 2018 @10:08PM (#16704010)
I'm not sure binary protocols are any better, unless you make the first two bytes of every message a version number.

FWIW, I consider the canonical implementation of SIP at this point to be asterisk.

I work on a SIP derived protocol, P25 CSSI - it has all the issues of SIP, and more!

Re:VPN leaks users’ IPs via WebRTC by blattimwind on Thursday March 29, 2018 @04:32AM (#16705462)
> I'm not sure binary protocols are any better, unless you make the first two bytes of every message a version number.

Actually we've seen people manage to fuck that up royally, too. Examples: Routers confusing MAC addresses starting with "6" with IPv6 packets. Various TLS implementations in proxies falling completely apart when they see an unknown version. Various TLS proxies falling apart when seeing an unknown extension. Far too many instances of "assert version==1" to list.

Re:VPN leaks users’ IPs via WebRTC by blattimwind on Thursday March 29, 2018 @04:37AM (#16705477)
VoIP phones sometimes just don't work with some destination numbers (OWA/jumbled audio/insta-disconnect/no-connection). Workaround: call with mobile phone.

...

Re:VPN leaks users’ IPs via WebRTC by avodonosov on Wednesday March 28, 2018 @05:54PM (#16702357)
SOAP has this property too.