External Control of Netflix channel?

Archived
41

“TheEndless” wrote:

“lucasgonze” wrote:
I wonder if there’s a way to have your Roku tell the extension what its IP is? Is there any Brightscript API for that?
The roDeviceInfo component has a GetIPAddrs() method that returns an associative array of IP addresses (wired and/or wireless), but I don’t think that’ll do what you’re talking about. The only way I know of for an external application to get that information be via SSDP broadcast. After all, there’s no way for the extension to talk to the Roku unless it already knows the IP address.I’ve been spending some time thinking about this. SSDP discovery is great if your platform can take advantage of it. But apps like Remoku (and other ‘web’-based services, and apps on platforms that ssdp isn’t implementable in, like WebOS) need another way to determine the Roku addresses on the local network. Here’s one possible way:

  • The Roku device can obviously already determine its own IP, as explained above.

  • The Roku website already provides owners with a list of units registered to their account, protected by a username/password login.

  • What if:
    A)The Roku device periodically ‘called home’ its local IP to the the owner website.
    B)The website offered an api that would give that information back to a requesting app/service/device, secured using Oauth or another suitable authentication scheme?

Then remoku could poll the Roku web api to get a list of units and their local addresses. This wouldn’t have to be limited specifically to remote apps, either. For instance, the MOG website could let users register their Roku accounts with MOG, then enable playback of the queue directly to the Roku. Obviously, this would require changes to the Roku firmware and web services, and ongoing support for any/all the traffic generated to owner.roku.com from the use of this feature, so I can understand why it might not be a path they’d want to pursue.

Another possibility would be to have a program run on a pc on the local network, that can use SSDP to do the discovery, then publish that info to a third-party website, like apps4tv. This wouldn’t require any involvement from Roku, but would require the user to locally install software, and for the website to maintain a secure database of registered users, and associated units and IP addresses (along with secured communication channels in each direction). I’m not keen on making Remoku server-dependent like that, nor to require users to install software and set up yet more accounts, nor the security implications such a solution would present (not to mention having to implement that software on Windows, Mac and probably Linux too). I’d much prefer calling the roku mothership and (with authorization) being provided the info directly.

42

“gonzotek” wrote:
I’ve been spending some time thinking about this. SSDP discovery is great if your platform can take advantage of it. But apps like Remoku (and other ‘web’-based services, and apps on platforms that ssdp isn’t implementable in, like WebOS) need another way to determine the Roku addresses on the local network. {/quote}

Why do you say UDP multicast (which SSDP is) is not implementable on WebOS? I can’t find read to that extent, except that you may need to call API to open firewall port.

“gonzotek” wrote:
I’d much prefer calling the roku mothership and (with authorization) being provided the info directly.

The approaches you describe are overcomplicated but more importantly are security and privacy concern. Roku provided my home IP address to third parties, say whaaat? :slightly_smiling_face: I don’t think that will pass muster with a CPO (chief privacy officer). Third parties controlling from the cloud your Roku player in your room is also creepy.

Why is it hard for you to ask your user to go to Settings / Player Info and ask them to copy the IP from there? You can cache that value in a cookie and moreover you can probably get the first 3 numbers from the browser host IP anyway, so we are talking about asking the user to enter one number when first using your web app or after on load you find out there is no connection (so you show popup asking them to check).

Here is additional idea (hack, really) but i don’t know what the browser abilities are to open multiple connections (js threads? async?): in overwhelming number of cases the Roku player will be in the same /24 network like the browser and the two IPs will be really close (routers tend to allocate dhcp in order, whether starting at .1 or .100). So if you could possibly start probing the network for Roku, chances are you will find it in 5-10 attempts (vs the worst case of 252).

In pytonish pseudo-code:


def checkForRoku(lastOctet):
  if 0 < lastOctet < 255:
    testIP = <construct IP w/network base and lastOctet>
    <if possible do host ping test first>
    # better if you can provide short connection timeout
    if <test over http for roku> : return testIP
  else: 
    return None

myIP = <last octet of my IP> # e.g. 9 for 192.168.1.9
for i in range(1,254):
  rokuIP = checkForRoku(myIP+i)
  if rokuIP: break
  rokuIP = checkForRoku(myIP-i): 
  if rokuIP: break

# and here rokuIP is either the correct IP or bupkis
43

“EnTerr” wrote:
Why is it hard for you to ask your user to go to Settings / Player Info and ask them to copy the IP from there? You can cache that value in a cookie and moreover you can probably get the first 3 numbers from the browser host IP anyway, so we are talking about asking the user to enter one number when first using your web app or after on load you find out there is no connection (so you show popup asking them to check).
That’s how it already works. The remote is also entirely client-side javascript. There are no server-side components, so capturing the request headers isn’t really an option.

As for Roku knowing your internal IP address, how is that a security concern? My Roku’s IP address is 192.168.12.132, what can you do with that?

44

“TheEndless” wrote:

“EnTerr” wrote:
Why is it hard for you to ask your user to go to Settings / Player Info and ask them to copy the IP from there? You can cache that value in a cookie and moreover you can probably get the first 3 numbers from the browser host IP anyway, so we are talking about asking the user to enter one number when first using your web app or after on load you find out there is no connection (so you show popup asking them to check).
That’s how it already works. The remote is also entirely client-side javascript. There are no server-side components, so capturing the request headers isn’t really an option.

As for Roku knowing your internal IP address, how is that a security concern? My Roku’s IP address is 192.168.12.132, what can you do with that?

You could request the netflix icon from a img tag, and check with javascript if the image loaded correctly

45

“brandon15811” wrote:

“TheEndless” wrote:

“EnTerr” wrote:
Why is it hard for you to ask your user to go to Settings / Player Info and ask them to copy the IP from there? You can cache that value in a cookie and moreover you can probably get the first 3 numbers from the browser host IP anyway, so we are talking about asking the user to enter one number when first using your web app or after on load you find out there is no connection (so you show popup asking them to check).
That’s how it already works. The remote is also entirely client-side javascript. There are no server-side components, so capturing the request headers isn’t really an option.

As for Roku knowing your internal IP address, how is that a security concern? My Roku’s IP address is 192.168.12.132, what can you do with that?

You could request the netflix icon from a img tag, and check with javascript if the image loaded correctly
You’d still need to know the subnet, otherwise you’re loading an awful lot of images.. :face_with_tongue:

46

“EnTerr” wrote:

“gonzotek” wrote:
I’ve been spending some time thinking about this. SSDP discovery is great if your platform can take advantage of it. But apps like Remoku (and other ‘web’-based services, and apps on platforms that ssdp isn’t implementable in, like WebOS) need another way to determine the Roku addresses on the local network.

Why do you say UDP multicast (which SSDP is) is not implementable on WebOS? I can’t find read to that extent, except that you may need to call API to open firewall port.My mistake, that does appear to be possible. Someone who develops with WebOS will have to confirm(and hopefully implement :slightly_smiling_face: ).
“EnTerr” wrote:

The approaches you describe are overcomplicated but more importantly are security and privacy concern. Roku provided my home IP address to third parties, say whaaat? :slightly_smiling_face: I don’t think that will pass muster with a CPO (chief privacy officer). Third parties controlling your Roku player via Roku web service is also creepy.Remoku (among other apps) can already control your Roku via web service, that’s what ECP is designed for. Any website/service could implement it. At least Remoku is open, and anyone can see for themselves exactly what connections are being made, and can run the code from their own servers, so that they can be as secure as they choose to.

I don’t think it’s overly complicated (from a user perspective), nor is it insecure, to be presented with a one-time authorization page that asks permission to retrieve this info from a roku account. Facebook, Twitter, and Google all routinely support requests for, and transmission of, much more valuable personal data than a local IP.

Why is it hard for you to ask your user to go to Settings / Player Info and ask them to copy the IP from there? You can cache that value in a cookie and moreover you can probably get the first 3 numbers from the browser host IP anyway, so we are talking about asking the user to enter one number when first using your web app or after on load you find out there is no connection (so you show popup asking them to check).That’s what I’m doing now, and what all remotes had to do before they implemented SSDP(or the scan you suggested below..I think DVPRemote for iPhone did this pre-ssdp). You can’t get any part of the ip address from pure javascript, which is by design. Javascript doesn’t allow any detection of the local ip address, so the user has to enter more than just the final octet. We could use something other than pure js, like a java applet, but that limits us to platforms where java runs. In other words no iOS, and (without looking) probably not Kindle or Nintendo DSi, all devices that remoku currently works on.

Here is additional idea (hack, really) but i don’t know what the browser abilities are to open multiple connections (js threads? async?): in overwhelming number of cases the Roku player will be in the same /24 network like the browser and the two IPs will be really close (routers tend to allocate dhcp in order, whether starting at .1 or .100). So if you could possibly start probing the network for Roku, chances are you will find it in 5-10 attempts (vs the worst case of 252).I’ve done this in an unreleased copy of remoku. It works. It’s still a hack compared with an authorized request for the info. It still requires re-scanning(for an indeterminable amount of time, even if short) any time an ip changes, versus a request to the web-service (In plain english: App:“Has there been any change to any roku registered to this account since the last time I asked?” Roku:“No.” OR Roku:“Yes. ROKUSERIAL# is now 192.168.1.13”).

Like I said already, the second proposal doesn’t require anything further from Roku. If someone wanted to maliciously implement parts of it today, to collect the local addresses of Roku units would be trivial. Stick the code in any of the several Roku home media servers that are out today and let it report back to a public server somewhere. What I suggested in the first scenerio would give Roku and users control over who has requested access to the info, with the ability for either the user or Roku to revoke access at any given time. Like I already said, I can also see the objections Roku might have to implementing this on their end.

47

“TheEndless” wrote:
As for Roku knowing your internal IP address, how is that a security concern? My Roku’s IP address is 192.168.12.132, what can you do with that?

Personally, I would like to know myself what the concern is, yes. But there are others that impress it is an issue, random URL here: http://www.auditmypc.com/internal-ip-address.asp

Why are we striving so much to implement ECP in Javascript, just to prove Atwood’s Law (Any application that can be written in JavaScript, will eventually be written in JavaScript)? Here it seems to be the wrong tool for the purpose, after given reasonable amount of effort. Sometimes microscope can be used to hammer a nail - pity as it is - and sometimes pickax can’t screw a Philips head, why ask the manufacturer make pickax-compatible screws?

ps. Is there a javascript to discover and control my iPod Touch?

48

“EnTerr” wrote:
Why are we striving so much to implement ECP in Javascript,
Portability. The beauty of Remoku is that I can save it to my desktop and launch it locally if I want, without the need for a web server.
The ECP requests are also made on the local network, which the web server wouldn’t necessarily be able to see, so a client-side solution makes more sense.

49

“EnTerr” wrote:

“TheEndless” wrote:
As for Roku knowing your internal IP address, how is that a security concern? My Roku’s IP address is 192.168.12.132, what can you do with that?

Personally, I would like to know myself what the concern is, yes. But there are others that impress it is an issue, random URL here: http://www.auditmypc.com/internal-ip-address.aspI don’t see much relevancy in that page, with regard to the issues present to Roku in the context of this discussion. Roku units on a local network broadcast their addesses. They respond to any command from any host, without regard to authentication, local or remote connection, or previous session activity. They’re inherently insecure in this regard and my proposal that Roku provide a secured api for access to the local ips(versus catching the ssdp broadcast) does nothing to make that worse.> Why are we striving so much to implement ECP in Javascript, just to prove Atwood’s Law (Any application that can be written in JavaScript, will eventually be written in JavaScript)? Here it seems to be the wrong tool for the purpose, after given reasonable amount of effort. Sometimes microscope can be used to hammer a nail - pity as it is - and sometimes pickax can’t screw a Philips head, why ask the manufacturer make pickax-compatible screws?Multi-platform support. If a device has a semi-modern browser, it can control the Roku. I didn’t consider devices like the Kindle or Nintendo DSi when I started Remoku. I set out to learn some html5 techniques, and write a remote that I could use on my pc and iPhone. I hoped it would work on Android. It was the users who tried it on a bunch of different devices, and it turned out to be very compatible across many different phones, tablets and game systems. I wouldn’t necessarily want to use a Kindle to control the Roku, but in a pinch, it’d get the job done.> ps. Is there a javascript to discover and control my iPod Touch?Probably not, as Apple hasn’t published a protocol for it. Being that Roku HAS published one, and has already made certain choices about security vs. usability, I don’t see why we can’t discuss further improvements to it.

50

“gonzotek” wrote:

“EnTerr” wrote:
Personally, I would like to know myself what the concern is, yes. But there are others that impress it is an issue, random URL here: http://www.auditmypc.com/internal-ip-address.asp
I don’t see much relevancy in that page, with regard to the issues present to Roku in the context of this discussion. Roku units on a local network broadcast their addesses. They respond to any command from any host, without regard to authentication, local or remote connection, or previous session activity. They’re inherently insecure in this regard and my proposal that Roku provide a secured api for access to the local ips(versus catching the ssdp broadcast) does nothing to make that worse.
…
ps. Is there a javascript to discover and control my iPod Touch?
Probably not, as Apple hasn’t published a protocol for it. Being that Roku HAS published one, and has already made certain choices about security vs. usability, I don’t see why we can’t discuss further improvements to it.

Aha! So you do recognize that some line had to be drawn in regards of security and that has been in clearly separating to private, trusted network and public, untrusted one. So you should realize as well that you are calling to “pierce the veil” of that, bluring the demarcation and involve Roku in said crossing. My limited observations on corporate CYA say it ain’t gonna happen.

You know, it would have been so easy if SOHO routers bothered after providing DHCP to register the host in dynamic DNS, since they play DNS proxy anyway - and answer unqualified host names first from that cache - so you know you can simply address the first of the players as say “http://RokuPlayer1:8060/” and so on. But they don’t - or at least my Linksys does not. (And if they did, then the N-th player registering on the subnet can try first to ping RokuPlayerN first and then register if available)

51

lucasgonze, did you ever get a chance to try again with the new version I uploaded? and/or with hard-coding the IP? I’m curious to know if you got it working or if there’s anything else I can try. chrome’s javascript console would be another place to look because some kinds of errors would show up there.

personally I don’t think it’s too much of an issue for users to enter the IP. roku makes it pretty easy to find. it’s more of a hassle than not having to do it of course.

52

whaleface, I now have it working with no modifications. The problem must have been a user error. I have have been on the wrong subnet, had the Roku IP wrong, etc.

53

“lucasgonze” wrote:
whaleface, I now have it working with no modifications. The problem must have been a user error. I have have been on the wrong subnet, had the Roku IP wrong, etc.

oh, great. do you mean you didn’t even have to install the second one (i.e. in the extension page it says version 0.0.1, not 0.0.2)? that would be cool because it would mean I can remove the “this extension has access to all of your data” permissions. but either way I’m glad it works!

54

0.0.1 is the version, that’s right.

BTW I’ll be at Music Hack Day in New York this weekend with some Rokus and free MOG subs for hackers.

55

“lucasgonze” wrote:
0.0.1 is the version, that’s right.

BTW I’ll be at Music Hack Day in New York this weekend with some Rokus and free MOG subs for hackers.

very nice, I’m glad that works. music hack day looks cool, I hadn’t heard of that before.

56

lucasgonze, it’s been a while, any updates related to this on the mog channel? I have to say that since I installed the extension, I have used it on a daily basis and I hardly ever use the roku remote for mog anymore. I also have a little more free time these days so I might be inclined to polish it a little for release if the ECP changes made it to the main channel (or did they make it there and I never noticed?). not that I have any idea of how many people use mog on a roku and also have google chrome handy, but I’m sure there’s at least a few. :slightly_smiling_face:

57

Hi whaleface,

We have done a push to the main channel that contains the ECP support.

I’m really interested to learn about how addictive the web-based interface has been for you. I haven’t personally been using it regularly even though my laptop is usually right there when I’m using MOG on Roku. I’ll try to get in the habit and see how it feels.

58

oh, that’s great that you guys released it. sorry for not noticing, I’ve been using the beta you set up. :slightly_smiling_face: can you give me the official mog channel’s app id so I can set it up? I’m not sure how to find it and I just have the id for the beta channel.

59

“whaleface” wrote:
oh, that’s great that you guys released it. sorry for not noticing, I’ve been using the beta you set up. :slightly_smiling_face: can you give me the official mog channel’s app id so I can set it up? I’m not sure how to find it and I just have the id for the beta channel.I’m sure lucasgonze will chime in with his, but you can use the apps query to get the ids of any channels you have installed, for instance on my dev box:
GET http://rokuip:8060/query/apps
Response:

<apps>
<app id="5127" version="1.0.9">Roku Spotlight</app>
<app id="11" version="2.1.21">Roku Channel Store</app>
<app id="12" version="2.3.20">Netflix</app>
<app id="1453_c" version="1.1.100925">TuneIn Radio</app>
<app id="28" version="1.0.22">Pandora</app>
<app id="2049" version="1.82.0">MOG music</app>
<app id="13" version="2.0.0">Amazon Instant Video</app>
<app id="2285" version="1.9.1">Hulu Plus</app>
<app id="2267" version="1.1.0">HGTV</app>
<app id="1152_1" version="0.0.0">TED Talks HD</app>
<app id="1968" version="1.0.101028">Flixster</app>
<app id="45" version="1.5.0">Revision3</app>
<app id="1489_6" version="1.3.21">YouTube</app>
<app id="199" version="1.1.110207">The TWiT Netcast Network</app>
<app id="1980" version="1.1.100907">Vimeo</app>
<app id="1997" version="1.1.8">Chow</app>
<app id="1418_0" version="1.2.37">Nowhere TV</app>
<app id="1883" version="1.1.1">Picasa Web Albums</app>
<app id="2785" version="1.4.0">iTunes Podcasts</app>
<app id="3032" version="1.3.0">tv.com</app>
<app id="2835_f" version="1.0.110112">Roku USB Media Player</app>
<app id="3261" version="1.0.3">Photo Puzzle</app>
<app id="1616" version="1.0.1">NASA TV</app>
<app id="2016" version="2.0.33">Movies on Demand</app>
<app id="12_3" version="2.3.20">Netflix</app>
<app id="3634" version="1.5.20110413">Instant Watch Browser for Netflix</app>
<app id="dev" version="0.1.1">Remoku</app>
</apps>

And btw, your chrome extension is how I too most frequently interact with MOG on the Roku. :slightly_smiling_face:

60

This JS template code may be handy for hacking:


/* 
 * deviceIP: IP address of a Roku on your local network with MOG installed.
 *
 * tracks: array of MOG track IDs.  You can get these back from
 * EchoNest APIs or look around on mog.com for them, for example by
 * using the search function.
 */
function MOGRoku(deviceIP,tracks){
    var productionProgramID = "2049"; // if you're using a production MOG build
    var programID = productionProgramID; // set which one you're using by modifying this
 
    var form = document.createElement("form");
    form.method = "post";
    form.action = "http://"+deviceIP+":8060/launch/"+programID+"?trackIDs="+tracks.join("+");
    form.submit();
}
 
$(document).ready(function() {
    $("a#playone").click(function(){
	MOGRoku("192.168.201.49",[5639969]);
    });
    $("a#playmulti").click(function(){
	MOGRoku("192.168.201.49",[5639969,13203815,18362895,10936097,287941,539503,34731947]);
    });
    $("input#tidsubmit").click(function(){
	MOGRoku("192.168.201.49",$("input#trackIDs").val().split(" "));
    });
});