About DIDL-Lite metadata suggestion

[storaid]

Hi, Tiki

Recently, I have been discussing the issue of DIDL-Lite metadata with my friends who are familiar with UPnP development.

They suggested that DIDL-Lite metadata should undergo compliance check to ensure its reliability and security.

However, the issue is that some UPnP device vendors may not respect UPnP, which might result in inconsistencies in DIDL-Lite metadata (for example, GetPositionInfoResponse  or GetMediaInfoResponse).

They recommended offering an option for each UPnP Renderer device settings to decide whether to perform compliance warnings for DIDL-Lite metadata. For example:
DIDL-Lite metadata compliance warning: Yes or No

You could choose whether default value should be Yes or No.

– If the setting is No, no error messages will be displayed on the UI.
– If the setting is Yes, if the compliance check fails, an error message will be displayed on the UI, and the specific invalid metadata returned by the device will be provided, then stop the music playback

Here is an example of such an error message:

I am not sure how you check the XML of DIDL-Lite metadata.

Maybe you use libxml2 to retrieve and then validate the XML attributes.

Anyway, you might consider about this suggestion.

Thank you

[Tiki]

Hello, storaid. Thank you for notification.

What kind of compliance are you talking about ?

They suggested that DIDL-Lite metadata should undergo compliance check to ensure its reliability and security.

If there are possibilities of serious problems or known security risks in the TuneBrowser that I am not aware of, I would like to stop providing UPnP features, as I am finding that it is difficult to provide any further UPnP support.

Can you provide me with a URL where I can find more information on UPnP compliance check? (Currently, unfortunately, I have no information about it. If the compliance is including security issues as you said, it will be difficult to support by indivisual development. Anyway, I want to know the contents of compliance check)

P.S. For UPnP features, TuneBrowser is not using libxml2 and any other external UPnP libraries.

[storaid]

Hello, Tiki

The UPnP Renderer is a very useful feature, and I do not recommend discontinuing its support.

DIDL-lite metadata compliance check do not involve any particularly complex information.

They are simply used to ensure that the content of the DIDL metadata passed through SetAVTransportURI or SetAVNextTransportURI matches the DIDL metadata retrieved from the UPnP Renderer (e.g., GetPositionInfoResponse or GetMediaInfoResponse).

If the DIDL-Lite metadata compliance check fails, an error message pop-up will be displayed on the UI and stop the music playback.

Thanks

[Tiki]

I don’t understand why that check is a security measure. What kind of security are you worried about?

If another controller’s control comes in, of course it will not match.

[storaid]

Hi, Tiki

I asked my friend, and this is his opinion (though he’s not particularly focused on UPnP in audio development).

Generally, DIDL-Lite metadata is unlikely to pose a security risk for the intranet.

The security concerns are usually related to the UPnP Renderer (IoT), such as when the URI in the returned DIDL-Lite metadata is tampered with, for example: CVE-2020-12695.

However, this kind of mechanism serves other purposes:
1. Consistency: Ensuring that parts of the CreatedMetaData and ReceivedMetaData are consistent.
2. Compatibility: At the very least, it helps to identify whether the renderer is returning inconsistent DIDL metadata.
3. Reliability: Checking specific required metadata attributes against the original metadata can improve reliability.
4. Transparency: It helps to determine whether there’s a compatibility issue with the renderer (since some brands of UPnP Renderers don’t respect UPnP and return incorrect DIDL metadata).

Cases include:
1. Early WiiM firmware: Incorrect metadata returned (wrong DIDL metadata format).
2. ifi-audio streamer: The inconsistent metadata I mentioned previously.
3. Yamaha device (R-N803D): Wrong URI.

If the check fails, it could trigger a pop-up message with some information.

This is just a suggestion for your reference.

Thank you

[Tiki]

Thanks for the explanation.

If I have to continue to consider different proposals for another devices than the TuneBrowser problem, I still want to stop supporting UPnP.

[storaid]

Hi, Tiki

If possible, please don’t stop supporting UPnP.( Please, Orz)

It’s just a suggestion.

After all, your development of the CAS Player is one of the few that provides excellent UPnP support.

Currently, it’s quite difficult to find CAS players on Windows OS with good UPnP support.

Please Orz

Thank you

[Tiki]

I spend so much time analyzing and responding to your comments . I have not been able to take time for development. Please understand that.

[Tiki]

You always said other software could do it. Then use that software. I thought TuneBrowser was a bad software for you.

[storaid]

Hi, Tiki

I sincerely apologize for any inconvenience caused.

I have never complained about anything with this software.

TuneBrowser is currently one of the best software in terms of UPnP support.

And I have continuously recommended this software to other users.

Since TuneBrowser started supporting UPnP, I’ve always been very grateful for the improvements you’ve made to its UPnP functionality.

This is one of the very few music software on Windows that provides excellent UPnP support.

I truly hope you won’t give up on supporting UPnP.

I have always respected the developer’s suggestions.

If you can, please close this topic.

and, apologize again for any trouble caused.

Thanks

[WanFie]

plus one,
This is the best sounding audio software I know. I use it exclusively via UPnP. Without that feature it would be impossible for me to use it. I play almost without problems to a Teac UD-701n.

[Tiki]

Thanks.

WanFie san, thank you very much indeed.

[投稿者]

投稿