Since my previous post
garnered so much interest, I thought I'd do some proper analysis on the Oculus Home traffic, rather than the ~15 minutes of bandwidth monitoring that I did before posting that. If anyone has any other posts covering this topic, let me know and I'll add some links here - I'm not trying to be the vigilante that uncovers the great conspiracy.
Given that you shouldn't normally trust anything anyone says on the Internet, I'll start by saying that I am a technical person. My day job involves infrastructure and software design, so any criticism I make is not pulled from nowhere.
Apologies for the poor layout; I'm a bit pressed for time to do the full write-up now, so I'll put as much up as I can and then come back and finish this tomorrow.
Planned Process: 1. Uninstall Oculus Home 1. Checked that all services were removed (they were) 1. Re-install Oculus Home 1.
Run through set-up tutorial
1. Disconnect network 1. Shut down Oculus Home 1. Kill services 1. Restart PC and monitor services on start-up 1. Download and play a game
I'll use Wireshark for traffic analysis and TCPView for live monitoring throughout. Uninstall
Didn't spot any traffic, which surprised me. I would have expected a call home to announce me as a defector (or tell them my computer was no longer part of the collective). I'd be tempted to do it again after the re-install to double-check, but I'm being lazy. Maybe later. Install
Unsurprisingly, this downloads the software (840MB) from a FBCDN address. Happy to see it's SSL.
Unfortunately, the install process decided at this point that "something is wrong" (probably the recent uninstall), so it wouldn't proceed without a reboot... which means redownloading everything again. For me, not an issue; I have unlimited download and wide bandwidth, but it reeks of immature software (not an insult). Downloading a temporary package and reusing it is not "difficult". They've obviously designed from a "happy path" perspective (perfectly fine for a v1), but this will really upset people with limited/slow connections.
Reboot worked and took me straight to the store, which means that it didn't fully clear down some registry keys, because it remembered my Rift configuration (no tutorial) and it signed me in straight away. Second black mark, then, for not doing a complete uninstall. I'll consider a full uninstall and profile clear later, but since I don't expect it to really add much value to the analysis, I'm going to skip it. Services
So, as we all know, once installed OVRServer_x64.exe and OVRServiceLauncher.exe are always running. OVRServer_x64 has a constant connectioned established to a facebook.com address (no traffic). Even just sitting and watching the logs, without doing anything on the PC, I saw the occassional small burst of traffic (~1KB somtimes up to ~5KB) to facebook.com on a new connection. Given that all of this is happening over SSL, the traffic is slightly higher than the content. Some of it definitely looks like version checking (and uses fbcdn.com), but other bits need further analysis. (I'm not saying anything untoward is happening)
Given the name, I'm guessing OVRServiceLauncher exists purely to capture API requests and start Oculus Home if it isn't already. It doesn't appear to hold any connections, so that stacks up; but I will keep it in the monitor list. The logs show that the HMD is being polled every 5 seconds, so this also seems to confirm it, to some extent.
There's also some graph.facebook.com chatter going on, which I believe is what Oculus are using for the friends list. Given that I haven't got any friends in Home (don't feel bad for me), this might be quiet; if you've got a lot, it'll probably poll more frequently.
Disconnecting the network, the service loses it's connection (obviously), but as soon as the network is back, it's re-established to facebook.com. Oculus Home
Home (OculusClient.exe) did not appear to hold any connections open, presumably relying on the service for most network chatter. On startup, it does contact oculus
.fbcdn.com address and download ~5KB of data. I'm guessing it's updating the store front, but I'll need to dig further. Shutting down Home doesn't appear to affect the rate at which the service polls facebook.com. [Out of time - I'll try to complete this tomorrow] Summary and TL;DR:
The current functionality appears to be acceptable, even if it's a bit chatty. Given that this is a v1, I'm more inclined to call it out as inefficient rather than malicious.
If I was Oculus, I'd have the services either stop or go silent when not in use. Maybe a single version check, but nothing more. I'm guessing that (one of) the services is used to start Oculus Home when something talks to the API and requests access to the
Rift. This isn't an unacceptable nor unusual approach, but an official explanation wouldn't go amiss.
I'm making no comments on the whole "Facebook are evil" thing, I'm just analysing the traffic.