For a company who thrives on making cheap devices and charging for licenses/platform, this is almost a crime especially when supporting ipv6 on Linux based devices is much easier now. Wonder why don’t support it.
It's probably harder to tie devices in a single household together with IPv6 than with IPv4, or so they think.
They don't make (much) money on their devices, they make money on selling data collected and aggregated by their devices. Their "privacy" policy [0] is a hoot to read. "Whatever we can do, we will. If the laws of the country we collected the data in would interfere with that, we'll move the data and then do what we want." I mean, they grant themselves permission to nmap your network for other devices! Emphasis mine.
> We may receive information about the browsers and devices you use to access the Internet, including our services, such as device types and models, unique identifiers including advertising identifiers (e.g., for Roku Devices, the Advertising Identifier associated with that device), MAC address, IP address, operating system type and version, browser type and language, Wi-Fi network name and connection data, __and information about other devices connected to the same network__.
[0]: https://docs.roku.com/published/userprivacypolicy/en/us
So I wonder if this means it is harder to ID the consumer with IPv6 ?
It's probably easier, in fact. A significant and growing number of households are behind CGNAT on IPv4 and not have a 1:1 household : ip address relationship. On the other hand, if they're on IPv6, they're most likely on the same /64.
But, Roku's not doing IPv6 was handy for me when Netflix decided not to accept IPv6 connections over Hurricane Electric tunnels. I didn't have to change anything, and I didn't have to do anything, the Rokus were already ignoring IPv6.
They may also be doing more nefarious things, but this might just mean it watches for UPNP and other announcement-broadcast messages on your network (like, say, mdns).
(At least. Not saying they are not doing anything else bad, Just that there is a valid use.)
At least some people [0] have reported their Roku device scanning their network, which is explicitly allowed in that policy. Though you can probably do a lot of it passively without leaving those annoying traces.
Once they've granted themselves permissions to do it, why wouldn't you? Knowing a house is an Apple household with a lot of devices probably means they've got money, or at least a willingness to take on debt. You can get a sense of when devices come and go to help identify activity, and if you're particularly annoying, you could snoop wireless signal strength of other devices on the LAN to get an idea of who's in the room with you.
If it's only got a few Androids and Chromebooks, well, probably lower income. If you can't find a thing on the LAN, you're probably in the house of a computer security researcher and should behave. Etc.
If they meant to say "We watch for UPNP announcements to identify other content sources on your LAN," they could have said that. But they didn't. They left the door wide open to do whatever home LAN analysis they think they can get away with.
I mean, this is a company whose response to the "Do Not Track" bit is to ignore you [1]. No standards? It's literally in the name.
> Do Not Track
> Some Internet browsers include the ability to transmit “Do Not Track” signals. Since uniform standards for “Do Not Track” signals have not been adopted, the Roku Sites do not currently process or respond to “Do Not Track” signals.
[0]: https://community.roku.com/t5/Wi-Fi-connectivity/Roku-Device... [1]: https://docs.roku.com/published/cookiepolicy/en/us
Not just no, but hell no. I would 100% interpret that behavior as the prelude to an attack.
> The Roku box runs a custom Linux distribution called Roku OS.
Looks like yes.
Even if it wasn't, don't most embedded OSes come with IPv6 support? How small do you have to be to not have it? QNX is pretty compact, and even it has it:
* https://www.qnx.com/developers/docs/7.0.0/#com.qnx.doc.neutr...
There are also some scenarios (admittedly pretty contrived in our compute-rich world) where your TV computer is the only one available to you, and so it would be in your interest to expand its functions. Imagine a kid in a poor neighborhood - theoretically with just a keyboard and a USB stick he could be using that TV as an internet-connected computer to learn how to program. That's a lot more value than running Netflix, IMHO.
A RPi would be a much better choice for a poor kid in a neighborhood who wanted to have a way to program.