Comment by VTimofeenko

6 days ago

Most likely case is that the tv is computing hash locally and sending the hash. Judging by my dnstap logs, roku TV maintains a steady ~0.1/second heartbeat to `scribe.logs.roku.com` with occasional pings to `captive.roku.com`. The rest are stragglers that are blocked by `*.roku.com` DNS blackhole. Another thing is `api.rokutime.com`, but as of writing it's a CNAME to one of `roku.com` subdomains.

The block rates seem to correlate with watch time increasing to ~1/second, so it's definitely trying to phone home with something. Too bad it can't since all its traffic going outside LAN is dropped with prejudice.

If your network allows to see stuff like that, look into what PS5 is trying to do.

37 comments

VTimofeenko

Reply
godelski  5 days ago 

  > Most likely ... sending the hash

If you're tracking packets can't you tell by the data size? A 4k image is a lot more data than a hash.

I do suspect you're right since they would want to reduce bandwidth, especially since residential upload speeds are slow but this is pretty close to verifiable, right?

Also just curious, what happens if you block those requests? I can say Samsung TVs really don't like it... but they will be fine if you take them fully offline.

  • VTimofeenko  5 days ago

    > If you're tracking packets can't you tell by the data size? A 4k image is a lot more data than a hash.

    I admit, I've not gotten around to properly dumping that traffic. For anyone wanting to do this, there's also a spike of DNS requests every hour on the hour, even if tv is off(well, asleep). Would be interesting to see those too. Might be a fun NY holiday project right there. Even without decrypting (hopefully) encrypted traffic, it should be verifiable.

    > Also just curious, what happens if you block those requests?

    Due to `*.roku.com` DNS black hole, roku showed no ads but things like Netflix and YouTube using standard roku apps("channels") worked fine. I now moved on to playing content using nvidia shield and blocking outside traffic completely. Only odd thing is that the TV occasionally keeps blinking and complains about lack of network if I misclick and start something except HDMI input.

CursedSilicon  6 days ago

Hashing might not work since the stream itself would be a variable bitrate, meaning the individual pixels would differ and therefore the computed file hash

clbrmbr  6 days ago

What system do you use to get that level of visibility?

  • varenc  6 days ago

    Besides what others have said, another dead simple option is to use Nextdns: https://nextdns.io

    Doesn't require running anything locally and supports various block rules and lists and allows you to enable full log retention if you want. I recommend it to non-techies as the easiest way to get something like pi-hole/dnscrypt-proxy. (but of course not being self-hosted has downsides)

    edit: For Roku, DNS blocking like this only works if Roku doesn't use its own resolver. If it's like some Google devices it'll use 8.8.8.8 for DNS resolution ignoring your gateway/DHCP provided DNS server.

  • mschuster91  6 days ago

    Replace your router's DNS with something like pi-hole or a bog standard dnsmasq, turn up the logging, that's it. Ubiquiti devices I think also offer detailed DNS logging but not sure.

    • jakeydus  6 days ago

      I believe unifi offers aggregated dns logs ootb but you could always set up more detailed ones on the gateway itself.

  • drnick1  5 days ago

    My suggestion would be to configure your own router using a Linux distro. It's not as difficult as it sounds, the kernel already does most of the heavy lifting. All you need to really do is enable packet forwarding and configure the firewall using iptables rules (block all in, allow all out is a reasonable default). I use Unbound as my recursive DNS resolver, together with Hagezi's blacklists to provide DNS filtering. I filter ports 53 and 853, and filter by IP known public DNS servers (Hagezi maintains a list). DHCP is provided by the isc-dhcp-server package on Debian.

    That's a more or less complete home router, with plenty on spare resources to run internal or external services like a Wireguard tunnel, file server, or the Docker/Podman runtime.

    That being said, I still wouldn't connect a "smart" TV to the Internet. There are better options like a Linux HTPC.

  • nwellinghoff  6 days ago

    Pfsense firewall. There is a week long learning curve and it’s best to put it on dedicated hardware.

NuclearPM  6 days ago

I don’t know why you quoted the addresses.

  • __MatrixMan__  5 days ago

    It's polite to give parsers (human or otherwise) hints that they're about to encounter text which is now intended for a different kind of parser.

    I recently forgot to surround my code in ``` and Gemini refused to help with it (I think I tripped a safety guardrail, it thought I was targeting it with an injection attack). Amusingly, the two ways to work around it were to fence off my code with backticks or to just respond to:

    > I can't help you with that

    With

    > Why not?

    After which it was then willing to help with the unquoted code. Presumably it then perceived it as some kind of philosophical puzzle rather than an attack.

  • VTimofeenko  4 days ago

    Fair question, it does look a bit jarring when not rendered. I write a lot of markdown and it's a very strong force of habit to use backticks to sort of highlight a technical term and turn it into a noun. Similar to writing endash as a double hyphen.

    When I read what I write, my eyes glance through backticks and maybe come back if I need to parse the inner term in more detail.