Skip to content

references.md

Latest commit

 

History

History
51 lines (44 loc) · 2.89 KB

references.md

File metadata and controls

51 lines (44 loc) · 2.89 KB
Raw

References and acknowledged works

This project is built on other people's reverse engineering and measurement work. Where a specific finding came from one of these, it is credited at the point of use in the source.

Protocol and client implementations

  • RootMyTV — the LG webOS jailbreak. Source for the null-origin bypass explanation and for the observation that SSAP rejects HTTP origins while allowing null and file:// — the behaviour tv-privacy lab origins reproduces.
  • pywebostv — Python SSAP client. Reference implementation for the registration handshake.
  • lgtv2 — Node.js SSAP client, and the backbone of several home-automation integrations.
  • go-webos — a Go SSAP client, dormant since roughly 2020. Useful as a third independent reading of the protocol.
  • aiowebostv — Home Assistant's actively maintained SSAP library, and the source of the full READ/WRITE/Luna command table that lab/catalogs.py starts from. Read via its DeepWiki page rather than the repository directly.
  • webos-ssap-web — referenced but not examined directly; notable for proxying SSAP over a real web origin using a data: iframe, which is the practical consequence of the origin behaviour above.
  • bscpylgtv — its per-model settings dumps are where the candidate consent key names in lab/catalogs.py were harvested from, rather than guessed.

Measurement research

  • "Watching TV with the second-party" (arXiv 2409.06203), UC Davis / UCL / UC3M, ACM IMC 2024 — a black-box audit of ACR network traffic. The study behind three claims this tool leans on: that ACR fingerprints content even when the TV is used as a dumb display over HDMI, that the vendor opt-outs do measurably stop the traffic, and that sampling rates differ per brand. It is also why uncertainties.md recommends checking DNS logs rather than trusting the flags: that paper measured behaviour, this tool only reads state.
  • "The TV is Smart and Full of Trackers" (Varmarken, Le, Shuba, Markopoulou, Shafiq), PETS 2020 — Roku and Fire TV app-level tracking, and the effectiveness of DNS blocklists. The evidence behind this project's position that a Pi-hole is the stronger tool when you do not need working apps.

Structural precedent

  • iptv-org/database — CSV in git, PR-based contribution, CC0. The model for how a community-maintained per-model settings database could work here without a server or an account system.