Hacker News

Top stories

Live mirror
30 storiesupdated just nowView source snapshot
  1. Pirating the Pirates (mubi.com)
    67comments
  2. Hijacking the PS5's RTMP stream (yashgarg.dev)
    26comments
  3. Show HN: HN.watch – Videos of all Hacker News posts (hn.watch)
    23comments
  4. Joseph Szabo’s pictures of American adolescents (newyorker.com)
    1comments
  5. Who wrote Elizabeth I's most scathing letters? (smithsonianmag.com)
    3comments
  6. Parley: Federated, decentralised chat that speaks plain IRC (mills.io)
    124comments
  7. When did Google get so weird? (sancho.bearblog.dev)
    956comments
  8. Launch HN: Vespper (YC F24) – SOTA Docx MCP (vespper.com)
    2comments
  9. GrapheneOS – When an app is slow (wirelessmoves.com)
    7comments
  10. What heraldry and Japanese mon can teach about visual-identity generators (benovermyer.com)
    13comments
  11. Windows 11½ (definitelynotwindows.com)
    62comments
  12. MongoDB CEO resigns to join Meta (reuters.com)
    193comments
  13. Sonnet 5.5 (anthropic.com)
    165comments
  14. I made a visual workspace for AI Automations (biom.dev)
    9comments
  15. Cf: The Agentic CLI for the Cloudflare API (cloudflare.com)
    19comments
  16. So long Google, and thanks for all the nudes (lecaro.me)
    34comments
  17. OpenAI still doesn't seem to have a handle on all of its rogue AI activity (techcrunch.com)
    67comments
  18. Kids turned low-traffic NPR Spotify comments into a secret group chat (thisamericanlife.org)
    100comments
  19. 37,500 border drawings: a map of the world as people remember it (habibicode.org)
    31comments
  20. What Would a Serious AI Product Look Like? (glyph.im)
    26comments
  21. Footguns with Postgres “at time zone 'UTC'” (bookofrevenue.com)
    87comments
  22. Coding Is Not Solved (alexewerlof.com)
    368comments
  23. The problem is not AI code, but not knowing about system architecture or intent (ssp.sh)
    197comments
  24. Show HN: Destroy Any Website with Stickman (spritefusion.com)
    8comments
  25. Show HN: PaperMono, e-ink fridge magnet shopping list with mobile web page (github.com/seamusc)
    50comments
  26. Owed a billion dollars in Nvidia stock (colo.to)
    430comments
  27. Show HN: Free alternative to graphics design giants (scissor.studio)
    33comments
  28. Solving a corn puzzle with CP-SAT (thill.me)
    5comments
  29. Ember-1 (fireworks.ai)
    243comments
  30. Nissan's third generation e-POWER powertrain (nissan-global.com)
    343comments

Hijacking the PS5's RTMP stream

105 pointsby 3h agoyashgarg.dev
26 comments
2h agoHN ↗

Maybe I'm missing something but there seems to be a gap between "figure out the REAL hostname" and "we no longer have to worry about the stream never showing up on YouTube"

2h agoHN ↗

Me too. YouTube was given up, and what the op did was to use Twitch streaming and redirect it before the forward to a TLS-verifed server, bypassing verification:

redirects the actual stream to the Mac without any certificate issues.

2h agoHN ↗

The live-video.net domain belongs to Twitch. So, from what I can gather, apparently the OP switched back to Twitch streaming and the last-hop RTMP server does not use certificates.

1h agoHN ↗

Another crypto mistake by Sony this time leaving traffic completely unencrypted.

1h agoHN ↗

is it truly a security issue here? Especially relative to the machine's effort to encrypt the stream.

25m agoHN ↗

My video stream sent to a public streaming audience might be seen by the public in transit!

3m agoHN ↗

Both YouTube and Twitch allow you to do non public streams.

25m agoHN ↗

Debatable, but historically quite a few consoles and handhelds have been popped wide open by leveraging defects or vulnerabilities in how media is handled. Without looking at an exhaustive list, I believe tif files have claimed the most victims with the next two being split between videos and then media within browsers. I'm aware this is more about out than in, but a gap is a gap and gamers will use whatever they can find.

1h agoHN ↗

PS5 uses DNS to resolve where to send RTMP stream. The author found out that they cannot spoof the main server since that server uses TLS and it's not possible to make the PS5 trust self made certificate. The author then runs a real Twitch stream and monitors DNS requests and finds DNS of the server that receives the RTMP stream and spoofs only that final server. It's more of a problem with RTMP protocol/Twitch security rather than the PS5.

1h agoHN ↗

Don't mind me, I'm just sitting here with my HDMI-RX port on rk3588 being happy that is works and I didn't brick the board when doing uboot update to uncurse it.

1h agoHN ↗

You can combine the last two steps the nginx and mpv with obs and gstreamer, or just gstreamer really.

43m agoHN ↗

Vote with your $ and get a gaming PC. Don’t let people who remember the 1990s tell you it will be a sweaty experience, install Steam and it won’t be. There are like 15 exclusive games for the PS5, what’s the point?

33m agoHN ↗

Don’t use Windows. Try CachyOS or Bazzite.

33m agoHN ↗

Depending on what you play, you don't have to. But if you play draconian anti-cheat games then fair point.

11m agoHN ↗

I vote with my time by not maintaining drivers, setting profiles, and evading anticheat rootkits. Also, M$ is cancer.

5m agoHN ↗

I just click "Install" and then "Play" in Steam on my non-Windows machine. I guess you can't play Fortnight or whatever, but it works great for me.

3m agoHN ↗

Playing 20 or so games on my Steam Deck I had to edit one only .INI. The Steam Deck is the only device I've ever seen that pairs perfectly with AirPods every time, it beats Apple devices.

I also have a big gaming PC/AI development with a NVIDIA GPU and, yeah, NVIDIA's app to maintain drivers is a little skeezy but I just download games on Steam and they "just work" though I am not really a day one kind of gamer unless it is a new Dynasty Warriors or Fate game.

I'll grant that kernel anti-cheat sucks, if you play that kind of game and cheating bothers you well then... Maybe a locked down environment like the PS5 is a feature and not a bug.

3m agoHN ↗

Sorry, already own a PS5 and the money for replacements is spoken for.

I think that was the point?

9m agoHN ↗

I'd kill for a Bluetooth peripheral workaround. I've a Clicks Power Keyboard that'd be great to use with the PS5.

1m agoHN ↗

Imagine if they just let you specify your own RTMP destination. Crazy thought, I know.