RE: Real Audio Security

[Rick Murphy <rmurphy () mitretek org>]

At 01:06 PM 1/21/00 +0300, ark () eltex ru wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
>
> nuqneH,
>
> Hmmm ;) AFAIR Gauntlet has its own RA proxy, probably based on PN's
> reference implementation available from their site - what's wrong
> with it , why should you use web proxy ;)?

The Gauntlet RealAudio proxy predates the PN reference implementation. It 
does a bit more checking for valid protocol than the reference does. One 
big hole is that it permits the UDP flow to be from anywhere since several 
sites send the audio stream from a different source address from the 
controller (I seem to remember seeing one real-time streaming feed actually 
shift from one source address to another on the fly).
        -Rick