Shared online instance of LMS for Squeezebox Radios possible?

[benjaoming]

Basis

I'd like to ask firstly from an economical and environmental perspective, if it makes sense to host a large online alternative to mysqueezebox.com, possibly with a subscription fee for each user.

• Thousands of radios possible to save from becoming e-waste?
• Cooperative, meaning that the idea is build the economy on a platform that doesn't collect profit for an owner, but rather for the LMS Community.
• Shared administration (not as an individual task)
• No need to buy and maintain home-servers.
• Is it too expensive (resource waste) to be a streaming proxy?

I also have a speculation that there might be a lot of accessibility-related benefits, i.e. users that are more in need for a solution because a) switching internet radio device is costly and b) building and configuring their own LMS server isn't realistic.

Technical challenges

My next question is then: Is the project ready for such usage? Or what might be missing?

• Can a single LMS handle many users? (Or what needs to be done to get there, i.e. scaling it "horizontally")
• Are their security concerns, i.e. that traffic can be manipulated or hijacked?
• Can users interfere with each other?
• What are privileged users entrusted with?

[michaelherger]

Hi @benjaoming - some of what you suggest has been discussed on forums.slimdevices.com. And the consensus was mostly that yes, it would technically be possible (of course, as MySB has proven) but yes, it would likely be too expensive, and too much work to do on a large scale.

MySB was initially based around LMS 7. But various parts got replaced over time to improve scalability. Eg. streaming/ip3k player control was separated from the Radio/Touch/Controller control and the web UI, user separation needed to be added, higher level of security, bandwidth usage optimizations etc. All of this would need to be built again.

My believe unfortunately is that it's too late now anyway. By the time such an infrastructure was up and running most users not willing to run LMS probably have moved on anyway.

That said I'm still wondering whether a scaled down version to cover the need of a smaller circle of users (a few dozen) with a limited feature set (radio only) wouldn't be feasible. There recently have been reports of successfully running a VPN on device (Radio/Touch only), which solves part of the security problem. Maybe a few tweaks to LMS to disable controlling other devices. Instructions to set up LMS with OpenVPN in a datacenter (or a docker compose file).

It would need a group of dedicated people to figure it out. You'd rather find them on forums.slimdevices.com than here. Feel free to post your ideas there!

[benjaoming]

Thanks so much for all the great pointers @michaelherger 🙏

I've been playing with Wireshark to see the traffic between my radio and LMS. I have the rough idea that LMS can run as a local service with a new public-facing proxy that provides necessary safety layers:

• HTTP traffic on port 9000 can be SSL encrypted (as understood here). An HTTP proxy is placed in front of slimserver and can perform user management an authorization on forwarded HTTP traffic.

• SlimProto traffic (TCP and UDP) on 3483 is the tough nut: IS it in fact safe, since it's unencrypted? We need to build a proxy server that performs some authorization and filters out unsafe commands.

[michaelherger]

Proxying port 9000 and adding encryption won't work, as the players use that port, too. And they can't handle https.

[benjaoming]

Ah okay. Check. But would this be accurate to what can be done at best, i.e. what mysqueezebox.com did for Squeezebox Radios?

• HTTP traffic on port 9000 is unencrypted, handles authentication of user and some other commands that do not expose the player to playback control.
• SlimProto traffic (TCP and UDP) on 3483, a subset of commands that do not expose the player to have its playback controlled.

The thing that worries me a bit is that there would be a potential of MiM attacks lurking. But maybe it's acceptable, as privacy is already impossible without the SSL layer.

[michaelherger]

what you'd have to be worried about foremost is that somebody on the outside could take over control over your radios

https://forums.slimdevices.com/showthread.php?107165-IMPORTANT-Stop-forwarding-your-LMS-ports-to-the-internet!

[benjaoming]

@michaelherger I worry about something similar but I'm not looking for a setup that requires open ports through a home router's NAT.

I wonder more about how mysb could worked. Without SSL, there is no CA to authenticate traffic, and any MiM could manipulate traffic, furthermore because it's unencrypted.

So I wonder if mysqueezebox.com had somehow solved the problem by only allowing through a subset of the protocol - or if the risk has simply been accepted for the sake of convenience.

From a personal perspective, I wouldn't care, I just want my radio to work. No one can initiate traffic to a Squeezebox Radio behind a home router NAT, the risk would come from MiM attacks. If that risk was already present for mysqueezebox and nothing ever happened, perhaps it's fine to accept and just try to copy the subset of the protocol that was allowed through.