Hacker News Reader

You can do without using a server. https://github.com/cjb/serverless-webrtc

"A STUN server is still used to find out your external IP for NAT-busting."

essentially, now the STUN is the MITM. STUN server lies to both parties about what their IP addresses are and responds with IPs that it controls. Both parties connect to those IPs and the messages are relayed between them.

This is incorrect. Once data starts to flow, DTLS is used to encrypt the connection and verify each peer's identity. If the STUN server attempts to MITM, it will be detected.

Maybe I'm reading your comment wrong (if so, sorry!), but that sounds like a race condition to me.

Reply on news.ycombinator.com