5 ms·

Explanation, from Reddit: > Pokémon sends a network discovery packet to each device on port 26037. Roku also listen on that port for LAN based updates so that

Explanation, from Reddit: > Pokémon sends a network discovery packet to each device on port 26037. Roku also listen on that port for LAN based updates so that multiple devices on the same network can update each other. It was an obvious decision. Saved Roku around a quarter million dollars in CDN traffic costs. Roku is popular in the commercial space where it’s often used as a media source to control sometimes 100s of TVs on the same network. It just so happens that Pokémon’s network discovery packet shares the exact same bytes as Roku’s signed bytecode to reboot. > The odds are astronomically low. We could have wound up with an alien planet full of Justin Timberlake clones, but the universe decided this was our colossal fluke.

emiliobumachar 7y ago
> It just so happens that Pokémon’s network discovery packet shares the exact same bytes as Roku’s signed bytecode to reboot. > The odds are astronomically low. Interesting. Any chance anyone here would know exactly how many bytes we're talking about?
- fpgaminer 7y ago
  Assuming by "signed" they mean cryptographically signed, and they're not doing something dumb, then the signature itself would be at least 16 bytes. It'd be ~impossible for a collision to ever occur by accident. So either "signed" means something different in this context or GameFreak replicated Roku's reboot packet for some reason.
  - dragontamer 7y ago
    > then the signature itself would be at least 16 bytes. Indeed, and 16-bytes is SHA1 or MD5, both considered insecure at this point. 32-bytes (SHA256) seems more likely to me. So I'm going to bet that they aren't "signing" the packet.
    - jlgaddis 7y ago
      AES-128 is also 16 bytes (128 bits), which is still (and likely will be for many, many years) completely secure, for all intents and purposes. (SHA1 is 20 bytes, BTW.)
      - dragontamer 7y ago
        AES-128 is encryption, not a hash. AES-128 will be broken when computers get enough compute power to calculate 2^127 keys (the brute force attack: after covering 50% of the keyspace). Cryptographic hashes are prone to the birthday attack instead. MD5 hashes (128-bits) are broken when a computer has enough power to calculate 2^64 keys (birthday attack: they found a hash collision).
    - sfoley 7y ago
      SHA-1 is 20 bytes.
chowells 7y ago
What use is signing a reboot request if the bytes are the same every time? At that point it's just a secret and might as well be random, rather than a signed request. (If you're going to use signing, include a timestamp and/or request id for replay prevention.)
pvg 7y ago
Given that it's posted in /r/ProgrammerHumor, I don't think this is an explanation or intended to be one. https://www.reddit.com/r/ProgrammerHumor/comments/dy0p86/how_do_you_even_begin_to_debug_something_like_this/f7xzay7/?sort=new https://www.reddit.com/r/ProgrammerHumor/comments/dy0p86/how...
- saagarjha 7y ago
  /r/ProgrammerHumor occasionally used to have good technical inside behind the jokes; I used to enjoy reading them and writing my own. Sadly I've stopped visiting because the subreddit's been overrun by "JavaScript bad" and bad volume controls (which isn't even programmer humor?)
  - pvg 7y ago
    I mean, I'm sure /r/ProgrammerHumor has had real knee-slappers of great technical sophistication. This, obviously, is not one of them. Still, it's not that unusual for a joke to be mistaken for a real thing, reported in the media and then further repeated by others - as has happened here. It boggles my mind, though, that instead of having a friendly chuckle at this perfectly human mistake, we have it as a top comment on a thread - complete with subthread where 'shenanigans' are being called, it's subject to some earnest (albeit quite iffy) speculative analysis and, most astoundingly, a claim is made (by the shenanigans-caller) that even though it's plainly a joke posted on what is plainly a joke forum, it might contain a true description of the bug. The only thing we're missing are some back-of-the-envelope estimates of whether Roku really saved $250k on CDN fees and whether Roku devices are, in fact, used in commercial settings. It's one of the weirdassest things I've seen on HN (a forum, it is worth recalling, on which the intellectual rigour the discipline of programming instills in its practitioners is frequently extolled) and I've been here a while.
    - jlgaddis 7y ago
      Amen!
Rooster61 7y ago
I'm skeptical of this. Did they provide any proof to that effect? The odds are indeed INCREDIBLY low, low enough for me to suspect Roku doing something lazy in their network traffic sanitization. EDIT: Nope, nothing. They just stated it as fact and left it it at that. I'm calling shenanigans. Amusing theory, but it really is too incredulous to believe without any evidence.
- pvg 7y ago
  Look at the name of the subreddit.
  - Rooster61 7y ago
    Yes, it's called ProgrammerHumor. No, that doesn't automatically mean someone's posting something sarcastic/bullshit. I'd find a collision of such low probability very humorous if it actually happened.
    - pvg 7y ago
      It makes it very likely it's a joke. There's really no reason to treat it as anything else, just because it got mistaken for not-a-joke.
      - thayne 7y ago
        If it is a joke, it is very elaborate. Roku published a service alert about it: https://support.roku.com/article/115012351368 https://support.roku.com/article/115012351368
        pvg 7y ago
        The joke is the explanation not the fact that this issue exists.
    - akvadrako 7y ago
      It’s more than humorous - assuming the signature is secure, nothing that amazing has yet happened in the history of the universe.
yumraj 7y ago
> > The odds are astronomically low Not if both teams, or lazy developers on both teams, picked some sample code from a book, blog or public GitHub repo and didn't bother to make obvious changes.
bencollier49 7y ago
They probably both copypasted the same code from StackOverflow. /s
rolltiide 7y ago
Cmon guys, if its sharing the port AND the signing request packet then the same libraries are being used Jfc
archi42 7y ago
Maybe he means some leading magic bytes which match for both protocols. The Roku could then fail parsing the package with an inappropriate failure mode since the actual signature is bad or missing. I think it's funny.

emiliobumachar 7y ago

> It just so happens that Pokémon’s network discovery packet shares the exact same bytes as Roku’s signed bytecode to reboot. > The odds are astronomically low. Interesting. Any chance anyone here would know exactly how many bytes we're talking about?

fpgaminer 7y ago
Assuming by "signed" they mean cryptographically signed, and they're not doing something dumb, then the signature itself would be at least 16 bytes. It'd be ~impossible for a collision to ever occur by accident. So either "signed" means something different in this context or GameFreak replicated Roku's reboot packet for some reason.
- dragontamer 7y ago
  > then the signature itself would be at least 16 bytes. Indeed, and 16-bytes is SHA1 or MD5, both considered insecure at this point. 32-bytes (SHA256) seems more likely to me. So I'm going to bet that they aren't "signing" the packet.
  - jlgaddis 7y ago
    AES-128 is also 16 bytes (128 bits), which is still (and likely will be for many, many years) completely secure, for all intents and purposes. (SHA1 is 20 bytes, BTW.)
    - dragontamer 7y ago
      AES-128 is encryption, not a hash. AES-128 will be broken when computers get enough compute power to calculate 2^127 keys (the brute force attack: after covering 50% of the keyspace). Cryptographic hashes are prone to the birthday attack instead. MD5 hashes (128-bits) are broken when a computer has enough power to calculate 2^64 keys (birthday attack: they found a hash collision).
  - sfoley 7y ago
    SHA-1 is 20 bytes.

chowells 7y ago

What use is signing a reboot request if the bytes are the same every time? At that point it's just a secret and might as well be random, rather than a signed request. (If you're going to use signing, include a timestamp and/or request id for replay prevention.)

pvg 7y ago

Given that it's posted in /r/ProgrammerHumor, I don't think this is an explanation or intended to be one. https://www.reddit.com/r/ProgrammerHumor/comments/dy0p86/how_do_you_even_begin_to_debug_something_like_this/f7xzay7/?sort=new https://www.reddit.com/r/ProgrammerHumor/comments/dy0p86/how...

saagarjha 7y ago
/r/ProgrammerHumor occasionally used to have good technical inside behind the jokes; I used to enjoy reading them and writing my own. Sadly I've stopped visiting because the subreddit's been overrun by "JavaScript bad" and bad volume controls (which isn't even programmer humor?)
- pvg 7y ago
  I mean, I'm sure /r/ProgrammerHumor has had real knee-slappers of great technical sophistication. This, obviously, is not one of them. Still, it's not that unusual for a joke to be mistaken for a real thing, reported in the media and then further repeated by others - as has happened here. It boggles my mind, though, that instead of having a friendly chuckle at this perfectly human mistake, we have it as a top comment on a thread - complete with subthread where 'shenanigans' are being called, it's subject to some earnest (albeit quite iffy) speculative analysis and, most astoundingly, a claim is made (by the shenanigans-caller) that even though it's plainly a joke posted on what is plainly a joke forum, it might contain a true description of the bug. The only thing we're missing are some back-of-the-envelope estimates of whether Roku really saved $250k on CDN fees and whether Roku devices are, in fact, used in commercial settings. It's one of the weirdassest things I've seen on HN (a forum, it is worth recalling, on which the intellectual rigour the discipline of programming instills in its practitioners is frequently extolled) and I've been here a while.
  - jlgaddis 7y ago
    Amen!

Rooster61 7y ago

I'm skeptical of this. Did they provide any proof to that effect? The odds are indeed INCREDIBLY low, low enough for me to suspect Roku doing something lazy in their network traffic sanitization. EDIT: Nope, nothing. They just stated it as fact and left it it at that. I'm calling shenanigans. Amusing theory, but it really is too incredulous to believe without any evidence.

pvg 7y ago
Look at the name of the subreddit.
- Rooster61 7y ago
  Yes, it's called ProgrammerHumor. No, that doesn't automatically mean someone's posting something sarcastic/bullshit. I'd find a collision of such low probability very humorous if it actually happened.
  - pvg 7y ago
    It makes it very likely it's a joke. There's really no reason to treat it as anything else, just because it got mistaken for not-a-joke.
    - thayne 7y ago
      If it is a joke, it is very elaborate. Roku published a service alert about it: https://support.roku.com/article/115012351368 https://support.roku.com/article/115012351368
      - pvg 7y ago
        The joke is the explanation not the fact that this issue exists.
  - akvadrako 7y ago
    It’s more than humorous - assuming the signature is secure, nothing that amazing has yet happened in the history of the universe.

yumraj 7y ago

> > The odds are astronomically low Not if both teams, or lazy developers on both teams, picked some sample code from a book, blog or public GitHub repo and didn't bother to make obvious changes.

bencollier49 7y ago

They probably both copypasted the same code from StackOverflow. /s

rolltiide 7y ago

Cmon guys, if its sharing the port AND the signing request packet then the same libraries are being used Jfc

archi42 7y ago

Maybe he means some leading magic bytes which match for both protocols. The Roku could then fail parsing the package with an inappropriate failure mode since the actual signature is bad or missing. I think it's funny.