Rendered at 15:29:46 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
barake 18 hours ago [-]
This is how Lightstream Studio has provided stream overlay for consoles[1]. Some years ago Microsoft added them as an official destination using a better protocol and dropped the need for MITM hackery.
I used to work in this space and Lightstream was always doing interesting things, even if they never seemed to find PMF.
PMF… I love how we’ve invented a term which means “customers”. I know it’s not the point of your comment but the acronym in place of a common word will be tougher for folks to follow.
jonchurch_ 14 hours ago [-]
In case anyone gets to learn this today…
You can have customers without product market fit.
A product that hasnt found PMF could be a solution looking for a problem, or it might solve a true problem but that problem isn't important, durable, or (crucially) common enough to sustain a business.
So OP was saying that Lightstream Studios made some great stuff, but that ultimately the problem they were solving wasnt durable or widespread enough for the market to sustain the business they had built.
Background on Lighstream Studios is they did a streamer setup in the cloud, so you didnt have to run OBS locally. A lot of people seemed to want that at the time, especially console gamers, but the market changed around them. Consoles are way better at streaming without any other stuff now, and PC gamers largely settled on running OBS (for free) on their own existing hardware. They had like 17k paying customers at one point, so customers wasnt the smoking gun here.
jbs789 5 hours ago [-]
> wasnt durable or widespread enough for the market to sustain the business they had built
So the customers went away (not durable), and didn’t have enough customers (not widespread)?
barake 1 hours ago [-]
That's one scenario. You can actually have sticky, engaged customers at huge scale, and even marginal profitability, while lacking Product-Market Fit. But breaking even/modest profits do not equal success for venture backed firms or mega-corps.
A good example is the voice assistant hardware from Amazon and Google. The speakers are everywhere, basic daily use stats are likely solid, and retail display square footage remains huge. Yet almost no one will pay for the associated subscriptions or other premium services. The hardware was sold at a loss(?) expecting downstream revenue from services that customers simply don't value enough to buy.
Modified3019 17 hours ago [-]
Thanks, I had no idea what it meant (presumably “product market fit”).
“Pull My Finger” was going to be my best guess.
londons_explore 20 hours ago [-]
Kinda sad that it's 2026 and this data still goes over the internet unencrypted...
RTMP and all the video and audio protocols behind it aren't trivial either - I bet there are hundreds of exploits waiting to be found that any three letter agency sitting on the internet can use to take over your PS5 and all credentials stored within too...
rezonant 20 hours ago [-]
Well, the server just responds with acknowledgement information, the client is doing most of the work and most of the complex parts of RTMP are hand waved and faked by both the client and the server because no one cares about how Flash used to work.
So somewhat unlikely to be able to exploit it but have at it hass.
I'd imagine it'd be easier to exploit the server side, actually.
londons_explore 19 hours ago [-]
Yeah, but the server is most likely running the whole thing in a docker container with no permissions to do anything. Big companies security teams tend to require that when opening non-trivial third party code up to the internet.
The client on the other hand I would guess is running it's code as root, or at least something with full GPU access.
rezonant 18 hours ago [-]
I guarantee the RTMP process on a Playstation 5 is not running as root.
opello 19 hours ago [-]
Wouldn't this require a man-in-the-middle since the PS5 is transmitting data to a specific server, YouTube or Twitch in the article?
There are extensions to RTMP to use encryption or even just TLS. But do you mean that the risk of fragments of audio and video bitstreams going out unprotected presents a remote code execution risk? That seems less a problem of vulnerability and more one of privacy.
someonebaggy 18 hours ago [-]
I think everyone is just hardcoding a template RTMP conversation and not implementing it beyond looking for certain markers.
dylanger 8 hours ago [-]
It is pretty wild that RTMP without any TLS is a thing, anyone in the chain, ISPs etc could just sit there and log all RTMP traffic and tap the stream at any time.
londons_explore 7 hours ago [-]
Would be pretty funny for an ISP to MITM all streams and put a "internet provided by Verizon" watermark in the corner of all video...
hjkloinxbdj 5 hours ago [-]
This is not correct, twitch (AWS IVS) supports rtmps.
The OP didn’t intercept rtmp url, they intercepted the discovery endpoint.
19 hours ago [-]
happyweasel 6 hours ago [-]
Tunnel it
mixdup 23 hours ago [-]
Maybe I'm missing something but there seems to be a gap between "figure out the REAL hostname" and "we no longer have to worry about the stream never showing up on YouTube"
Sebb767 22 hours ago [-]
The live-video.net domain belongs to Twitch. So, from what I can gather, apparently the OP switched back to Twitch streaming and the last-hop RTMP server does not use certificates.
fnctrev 20 hours ago [-]
twitch doesnt actually require tls. it uses plain rtmp over port 1935 and rtmps over port 443.
Aissen 23 hours ago [-]
Me too. YouTube was given up, and what the op did was to use Twitch streaming and redirect it before the forward to a TLS-verifed server, bypassing verification:
> redirects the actual stream to the Mac without any certificate issues.
pierreortega 21 hours ago [-]
[dead]
Muromec 22 hours ago [-]
Don't mind me, I'm just sitting here with my HDMI-RX port on rk3588 being happy that is works and I didn't brick the board when doing uboot update to uncurse it.
concerneddork 22 hours ago [-]
Lucy, esplain please.
kotaKat 21 hours ago [-]
rockchip something-or-other that's on the KiwiPi 5B. iirc it can strip hdcp and all that jazz, too? one of the ports is labeled "HDMI RX" for input.
> I guess it just has an HDMI capture chip on-board. If you have a spare USB port, these are under $20 everywhere.
Any decent ones? I own a few that I use for managing (semi)headless machines and they all manage maybe 2-3fps
bschwindHN 14 hours ago [-]
AverMedia makes decent ones. I think Magewell makes "professional" ones that give you the best image quality (4:4:4), but I haven't personally used them so can't attest to their quality.
Then there are all kinds of USB cards from dubiously named manufacturers, most being some white label chip that everyone uses. Some can work decently, some have a terrible capture rate like you mentioned. Due to the nature of these sellers popping up and disappearing, I can't really make a recommendation.
numpad0 11 hours ago [-]
2-3fps is weird. They should all do (lossy compressed) 1080p30 over USB 2.0.
The lowest end of HDMI captures used to use HDMI-PAL converter wired to an S-Video capture chip onboard. That was completely superseded by MacroSilicon MS21xx chips that actually capture HDMI. The ones that are now everywhere are based on those MacroSilicon chips.
pjc50 6 hours ago [-]
Hah. A while ago I concluded that all the cheap PAL capture devices were so bad in software that my go-to setup became a PAL->HDMI converter followed by HDMI capture. It certainly crashed a lot less.
sigio 7 hours ago [-]
The $10-$20 ones on aliexpress should be fine in general. The $6 and below ones usually are SDTV/crap ones.
I have a bunch of the Hagibis branded ones, and they work perfectly for capturing 1080p60 from laptops and cameras.
Muromec 16 hours ago [-]
Opi5 plus rk3588 to be exact
jprjr_ 20 hours ago [-]
Feel like there's a few parts missing that I'm not getting.
The author mentions that the PS5 uses RTMPS to push video up to twitch - but suddenly it just uses plain RTMP?
sleepybrett 18 hours ago [-]
because he switched to it's youtube integration which doesn't support RTMPS...
mintplant 17 hours ago [-]
But that integration kept timing out, so the author switched back to Twitch and somehow found a plain-RTMP endpoint that time. I'm also confused.
jandrese 15 hours ago [-]
He realized that the discovery server was just handing out another hostname, so even though he couldn't spoof the discovery server since he knew the hostname it was going to provide he put that in his local DNS and point it at his server. Since the RTMP server was on a different domain the best solution would be to make a wildcard for that domain that points at his server, that way it won't break if Twitch shuts down or starts up a new server in his area.
HanShotFirst 14 hours ago [-]
As someone who works with RTMP/S a lot, I suspect the Twitch endpoint is accepting RTMP streams even if it specifies or usually expects RTMPS - I find very often that servers will accept both.
_madmax_ 5 hours ago [-]
If I was you I wouldn't advertise anything resembling a workaround about Sony's device as they are very keen on suing and swatting anyone looking under the hood of their "intellectual property".
qtalen 13 hours ago [-]
Building a gaming PC from scratch is getting more and more expensive these days. The PS5 doesn't come cheap either, so I've been thinking about using the streaming feature. Could it work if I bought a few PS5s, set up a little studio, and offered a cloud gaming service?
xyzsparetimexyz 8 hours ago [-]
The market for game streaming is very sparse but with extremely low latency requirements. Doesn't seem economical.
ImpostorKeanu 20 hours ago [-]
I'd kill for a Bluetooth peripheral workaround. I've a Clicks Power Keyboard that'd be great to use with the PS5.
Original article does complain about headphones, but I don't think Sony uses Bluetooth for their Playstation 5 headphones either, just their Playstation Link ones that are custom USB 2.4Ghz like most other gaming headsets
forestry 18 hours ago [-]
This is fantastic. Not being able to share my gameplay with friends on Discord is one of my biggest gripes.
asimovDev 8 hours ago [-]
I used to remote play on a second user on the PS5 and then used the controller connected to my PS5 to log into my main user profile and then game from there whenever I wanted to stream something to my friend(s). That way the issue of needing to connect the peripherals to the computer was solved
darvo31 11 hours ago [-]
Dealing with legacy protocols always uncovers interesting security quirks. RTMP on a PS5 just feels like peak enterprise tech.
asimovDev 8 hours ago [-]
Sony supported PPPoE on the PS4, I wonder how many people used that (not counting the jailbreak exploit)
000000000001 3 minutes ago [-]
The only time I've even looked at PPoE was for my A+, then to Jailbreak my ps4, never used it outside of that.
Rohansi 11 hours ago [-]
Twitch and YouTube use RTMP for receiving streams. They always have. Everyone streaming there uses RTMP.
bit_rot73 11 hours ago [-]
RTMP? That's a blast from the past for something so modern. Pretty clever to find an exploit there.
rezonant 20 hours ago [-]
Imagine if they just let you specify your own RTMP destination. Crazy thought, I know.
alexfortin 14 hours ago [-]
It seems like Sony has really mastered the fine art of being hated by its own customers.
Transformanshen 19 hours ago [-]
Honestly the DNS trick in this post is neat but I'm not setting up dnsmasq just to share my screen. This is the kind of thing where Sony could just let you stream to anything and they don't, and it's annoying
wolttam 16 hours ago [-]
I kind of think it's crazy to not have the ability to filter/rewrite DNS requests/responses on your home network (by any means, dnsmasq is just one of them)
tamimio 22 hours ago [-]
You can combine the last two steps the nginx and mpv with obs and gstreamer, or just gstreamer really.
drudolph914 18 hours ago [-]
excited to try this! i’ve had this exact same want from streaming to discord on ps5
PaulHoule 21 hours ago [-]
Vote with your $ and get a gaming PC. Don’t let people who remember the 1990s tell you it will be a sweaty experience, install Steam and it won’t be. There are like 15 exclusive games for the PS5, what’s the point?
asimovDev 8 hours ago [-]
I paid 400e for my PS5 in 2023. For the same budget, I'd need to hunt down used deals for hardware and then suffer through using Windows (if the hardware I buy ends up even working at all) because the only game I play requires annoying workarounds to work on Linux that technically break the ToS (since they bypass the kernel level anticheat) and could potentially end up in my account getting banned. I'd rather just put my PS5 on a VLAN and enjoy hassle free gaming with some downsides like not being able to stream my game to my friends on Discord once half a year. Don't get me started on DRMs and questionable PC ports where the 60 FPS targets in system requirements are under assumption of framegen and upscaling.
tantalor 21 hours ago [-]
I'd rather eat poison than use Windows.
occz 19 hours ago [-]
Linux works quite well for gaming these days. I have a desktop that used to run Windows 11, which is EOL, so I was faced with either upgrading to Windows 12 or trying out Linux on desktop.
So far there have been zero games that have had issues. Granted I've only really had time to play 5 or so games, but I am genuinely impressed with how far it's come.
ball_of_lint 9 hours ago [-]
Can confirm. Have been playing games on Linux for years now and with proton, the vast majority of games just work. And there's protondb to fix up the rest.
The one game I couldn't actually get working was Escape from Tarkhov because it has some windows-only anticheat. I.e. the developers chose to make it not work, not an accident.
Bazzite has been the most hands off linux distro I've ever used. I put it on my desktop and I only use it with an xbox controller at the TV. I've never had to plug in a keyboard or use a terminal. I don't even bother checking proton compatibility anymore, everything has just worked.
zamalek 21 hours ago [-]
Depending on what you play, you don't have to. But if you play draconian anti-cheat games then fair point.
someonebaggy 18 hours ago [-]
Valve's brought almost all games to Linux.
ImpostorKeanu 20 hours ago [-]
I vote with my time by not maintaining drivers, setting profiles, and evading anticheat rootkits. Also, M$ is cancer.
sampullman 20 hours ago [-]
I just click "Install" and then "Play" in Steam on my non-Windows machine. I guess you can't play Fortnight or whatever, but it works great for me.
PaulHoule 20 hours ago [-]
Playing 20 or so games on my Steam Deck I had to edit one only .INI. The Steam Deck is the only device I've ever seen that pairs perfectly with AirPods every time, it beats Apple devices.
I also have a big gaming PC/AI development with a NVIDIA GPU and, yeah, NVIDIA's app to maintain drivers is a little skeezy but I just download games on Steam and they "just work" though I am not really a day one kind of gamer unless it is a new Dynasty Warriors or Fate game.
I'll grant that kernel anti-cheat sucks, if you play that kind of game and cheating bothers you well then... Maybe a locked down environment like the PS5 is a feature and not a bug.
jameslars 20 hours ago [-]
You kind of undermine your own argument here. The Steam Deck is more a console than a PC, with lots of "just works" baked in either directly or through community support that makes it simple.
In 2026 I still have to mess with game settings, driver issues, and DRM garbage behavior as a primarily PC gamer. PC gaming is still a long way from "just works" and I think you probably just take for granted a lot of things you have to do to make it work vs a typical console experience.
PaulHoule 20 hours ago [-]
Look, in the 1990s I was horrified of PC gaming because I was always dealing with kids who thought they were having fun with their PC whereas they were really fighting with an ugly plastic oversized joystick that fell apart two times during a level and had to be recalibrated three times. Or that it was a sweaty battle with the keyboard and mouse that reprises the sweaty battle with the keyboard and mouse I have at work and with my productive hobbies.
I got into console gaming in the late 00's and had a few portables and an Xbox 360 and a PS 3 just after they became obsolete and played through the libraries. My favorite games were games for the PS Vita from Japanese publishers like Altus, Idea Factory and Acquire. When Sony and the publishers quit investing in the Vita those games went right to Steam. And my experience with Steam is, "click on the Steam icon", pair the Xbox controller, use the controller to pick a game, and sit back. Like yeah, there still are sweaty keyboard-and-mouse games and I might even play one once in a while, but I'd say my experience on the big machine is "console like" with the condition that the kind of games I play are "console like" games.
yjftsjthsd-h 17 hours ago [-]
In what sense is the steam deck more console than pc? I agree that there's convenience in it being a single target for people to work on, but it lets you run anything you want even on the stock operating system, and you can trivially replace that at will
SchemaLoad 16 hours ago [-]
The line between console and blurred significantly lately. Consoles became X86 machines running PC OSs but locked down. PCs gained options for console hardware with the same OSs.
These days the only difference between PC and Console is having a locked down OS. Which makes consoles seem purely a worse product, but the difference used to be a lot more.
PaulHoule 15 hours ago [-]
The deck is a standard configuration they can test for, the “works with Steam Deck” badge sells product, game publishers covet it. Problems with Proton get worked out.
jameslars 16 hours ago [-]
I boot into a video games only interface. To update I click a single button. This is exactly a console interface and user experience
Rohansi 10 hours ago [-]
SteamOS is basically just a Linux distro with Steam preinstalled and set to autorun in Big Picture mode at boot. Everything you are describing is available in the plain Steam client because SteamOS runs the same client. You can just set your PC to boot into Steam and get 99% the same experience.
3 hours ago [-]
sleepybrett 18 hours ago [-]
I haven't had a driver issue other than 'you didn't upgrade your drivers lately' on a gaming PC in years and years. The problem now with pc gaming is the cost to enter the market with the GPU, RAM and storage prices.
volkercraig 20 hours ago [-]
get an immutable linux distro
SchemaLoad 16 hours ago [-]
Immutability has been the greatest improvement on the linux desktop in a long time. I'd never recommend a traditional distro to someone who can't fix or install linux themselves because mutable distros tend to grow warts over time, and diverge from a clean state. Eventually requiring a reinstall to fix.
But immutable distros stay in a clean state, updates become trivial and safe, and can roll back in case of a failure.
Toslink 10 hours ago [-]
[dead]
sleepybrett 18 hours ago [-]
you'll be voting with a lot of dollars, look at the 4090 pricing these days? hell even the 4070 is north of a grand, JUST FOR THE GPU, now check the DDR5 prices...
someonebaggy 18 hours ago [-]
Do you actually need one?
16 hours ago [-]
sleepybrett 15 hours ago [-]
nah i got a 5070 at $675, but they are north of a grand now, and 5090s are 7k+
catchnear4321 20 hours ago [-]
Sorry, already own a PS5 and the money for replacements is spoken for.
I think that was the point?
PaulHoule 20 hours ago [-]
To be fair with the current RAM prices I don't want to replace any device right now!
charcircuit 22 hours ago [-]
Another crypto mistake by Sony this time leaving traffic completely unencrypted.
rf15 22 hours ago [-]
is it truly a security issue here? Especially relative to the machine's effort to encrypt the stream.
xd1936 21 hours ago [-]
My video stream sent to a public streaming audience might be seen by the public in transit!
charcircuit 20 hours ago [-]
Both YouTube and Twitch allow you to do non public streams. And someone can get the stream key and stream over you. With the twitch model where stream keys don't get replaced you can imagine a secondary market place selling access to stream content on compromised channels.
monster_truck 21 hours ago [-]
Debatable, but historically quite a few consoles and handhelds have been popped wide open by leveraging defects or vulnerabilities in how media is handled. Without looking at an exhaustive list, I believe tif files have claimed the most victims with the next two being split between videos and then media within browsers. I'm aware this is more about out than in, but a gap is a gap and gamers will use whatever they can find.
kcnaragam863 19 hours ago [-]
[flagged]
tvbusy 22 hours ago [-]
PS5 uses DNS to resolve where to send RTMP stream. The author found out that they cannot spoof the main server since that server uses TLS and it's not possible to make the PS5 trust self made certificate. The author then runs a real Twitch stream and monitors DNS requests and finds DNS of the server that receives the RTMP stream and spoofs only that final server. It's more of a problem with RTMP protocol/Twitch security rather than the PS5.
bigfishrunning 19 hours ago [-]
If sony wanted the ps5 to only send to twitch, they could absolutely enforce TLS authentication of the server, but they don't, so i guess send your video wherever.
I used to work in this space and Lightstream was always doing interesting things, even if they never seemed to find PMF.
1: https://support.golightstream.com/hc/en-us/articles/38643168...
You can have customers without product market fit.
A product that hasnt found PMF could be a solution looking for a problem, or it might solve a true problem but that problem isn't important, durable, or (crucially) common enough to sustain a business.
So OP was saying that Lightstream Studios made some great stuff, but that ultimately the problem they were solving wasnt durable or widespread enough for the market to sustain the business they had built.
Background on Lighstream Studios is they did a streamer setup in the cloud, so you didnt have to run OBS locally. A lot of people seemed to want that at the time, especially console gamers, but the market changed around them. Consoles are way better at streaming without any other stuff now, and PC gamers largely settled on running OBS (for free) on their own existing hardware. They had like 17k paying customers at one point, so customers wasnt the smoking gun here.
So the customers went away (not durable), and didn’t have enough customers (not widespread)?
A good example is the voice assistant hardware from Amazon and Google. The speakers are everywhere, basic daily use stats are likely solid, and retail display square footage remains huge. Yet almost no one will pay for the associated subscriptions or other premium services. The hardware was sold at a loss(?) expecting downstream revenue from services that customers simply don't value enough to buy.
RTMP and all the video and audio protocols behind it aren't trivial either - I bet there are hundreds of exploits waiting to be found that any three letter agency sitting on the internet can use to take over your PS5 and all credentials stored within too...
So somewhat unlikely to be able to exploit it but have at it hass.
I'd imagine it'd be easier to exploit the server side, actually.
The client on the other hand I would guess is running it's code as root, or at least something with full GPU access.
There are extensions to RTMP to use encryption or even just TLS. But do you mean that the risk of fragments of audio and video bitstreams going out unprotected presents a remote code execution risk? That seems less a problem of vulnerability and more one of privacy.
The OP didn’t intercept rtmp url, they intercepted the discovery endpoint.
> redirects the actual stream to the Mac without any certificate issues.
https://kiwipi.com/blog/rk3588-hdmi-in-test/
Any decent ones? I own a few that I use for managing (semi)headless machines and they all manage maybe 2-3fps
Then there are all kinds of USB cards from dubiously named manufacturers, most being some white label chip that everyone uses. Some can work decently, some have a terrible capture rate like you mentioned. Due to the nature of these sellers popping up and disappearing, I can't really make a recommendation.
The lowest end of HDMI captures used to use HDMI-PAL converter wired to an S-Video capture chip onboard. That was completely superseded by MacroSilicon MS21xx chips that actually capture HDMI. The ones that are now everywhere are based on those MacroSilicon chips.
I have a bunch of the Hagibis branded ones, and they work perfectly for capturing 1080p60 from laptops and cameras.
The author mentions that the PS5 uses RTMPS to push video up to twitch - but suddenly it just uses plain RTMP?
Original article does complain about headphones, but I don't think Sony uses Bluetooth for their Playstation 5 headphones either, just their Playstation Link ones that are custom USB 2.4Ghz like most other gaming headsets
So far there have been zero games that have had issues. Granted I've only really had time to play 5 or so games, but I am genuinely impressed with how far it's come.
The one game I couldn't actually get working was Escape from Tarkhov because it has some windows-only anticheat. I.e. the developers chose to make it not work, not an accident.
I also have a big gaming PC/AI development with a NVIDIA GPU and, yeah, NVIDIA's app to maintain drivers is a little skeezy but I just download games on Steam and they "just work" though I am not really a day one kind of gamer unless it is a new Dynasty Warriors or Fate game.
I'll grant that kernel anti-cheat sucks, if you play that kind of game and cheating bothers you well then... Maybe a locked down environment like the PS5 is a feature and not a bug.
In 2026 I still have to mess with game settings, driver issues, and DRM garbage behavior as a primarily PC gamer. PC gaming is still a long way from "just works" and I think you probably just take for granted a lot of things you have to do to make it work vs a typical console experience.
I got into console gaming in the late 00's and had a few portables and an Xbox 360 and a PS 3 just after they became obsolete and played through the libraries. My favorite games were games for the PS Vita from Japanese publishers like Altus, Idea Factory and Acquire. When Sony and the publishers quit investing in the Vita those games went right to Steam. And my experience with Steam is, "click on the Steam icon", pair the Xbox controller, use the controller to pick a game, and sit back. Like yeah, there still are sweaty keyboard-and-mouse games and I might even play one once in a while, but I'd say my experience on the big machine is "console like" with the condition that the kind of games I play are "console like" games.
These days the only difference between PC and Console is having a locked down OS. Which makes consoles seem purely a worse product, but the difference used to be a lot more.
But immutable distros stay in a clean state, updates become trivial and safe, and can roll back in case of a failure.
I think that was the point?