neverblog.net

The temporary flaw in ESPN360.com’s security, which was fixed on Monday night, might have temporarily dissuaded some from the notion that they could watch their beloved teams compete in the World Cup online. Thankfully, a company in China has a much better notion: P2P TV channel streaming.

TVUNetworks, based in Shanghai, has a beta download of their TVUPlayer available on their website, www.tvunetworks.com. The player works in a simple, yet ingenious way. Utilizing concept similar to that employed in peer-to-peer downloading software such as Kazaa, TVUPlayer streams the TV channel to you from another user who is running the software, and in turn utilizes your extra available bandwidth to serve the video stream to others. The result: no matter how many people connect, the video plays smoothly, with little to no lag. Quality’s not the greatest, but it’s free, and you’re probably at work, so it beats the hell out of nothing at all. To give an idea of how effective this is, consider that the download of the software (from TVUNetworks‘ servers) is currently proceeding at a mere 8-9kBps on most people’s computers, probably as a result of high demand from World Cup viewers. The streams, however, run great, and often actually improve in quality as the number of viewers increases.

TVU is currently trying to secure contracts with TV channels to broadcast through the TVUPlayer, but until then, bless their hearts, they’re just offering a bunch of streams for free. In addition to the ESPN and ESPN2 available, there’s CNN and some other (often international) channels. Kind of makes ESPN 360 obsolete…

Sports fans are a long-suffering crowd. We’ve endured rising ticket prices, wayward basketballs and players emerging from the fields of play, and even the ultimate ignominy of the $6 hot dog. But now we have to deal with being told we don’t matter.

Here’s what I’m talking about. ESPN, the sports channel and empire which proclaims itself to be a ‘leader’ in the sports world, recently debuted an online version of their TV service, called ESPN360.com. With ESPN 360.com, the lucky sports fans who subscribe to a limited list of cable providers (such as Adelphia) are automatically granted instant free access to this cornucopia of multimedia sports excitement. Everyone else gets a message suggesting they email their ISP to request that it add the ESPN360.com service to its list of offerings so that you, the sports fan, can get it for free.

Now, I understand that ESPN would not want just anyone to connect and start streaming video for free from a cable channel that normally requires a paid subscription. But I do have that subscription–I’ve been a loyal ESPN viewer through Comcast, DISH Network, and now Metrocast Cable of Belmont, NH. Hear that, ESPN? I pay just as much as the people 10 miles north of me who have Adelphia, but I simply can’t get access, because I need to petition my podunk provider to pay you guys.

And that’s what really gets me angry. The fact that I simply can’t get access to ESPN360.com, no matter what. There’s no option to create a subscription account for a standalone service, as in the case of Major League Baseball’s well-designed, well-executed, and fan-centric MLB.TV. Instead, I get a pithy request to petition my ISP. In other words, if ESPN can’t sell this service in huge contracts to large-scale ISPs, it’s not worth selling. ESPN, it appears, is above even selling a product to the fans themselves–they’re out for the big fish.

It wouldn’t be hard to correct this problem–many fans, I’m sure, would be willing to pay for the service on a monthly basis, so that they can watch it on the road in hotel rooms, at the workplace, and anywhere they might be that happens not to be on one of a few ISPs. If you let us buy it, we will come. MLB.TV proves that every day. But being forced to convince my cable provider to pay an extra cost to ESPN makes me feel about as unimportant as could be, and it sure doesn’t make me feel very good about what interests ESPN has at its corporate heart. I know money’s a huge part of sports, but so are fans, and you shouldn’t forget that.

NB:So please, if you agree with this standpoint, and you’re frustrated by ESPN’s attempt to use you as a marketing tool to cable providers and other ISPs, comment below or share this article with others. It seems pretty clear that ESPN will only respond to large groups with significant market shares, so let’s become a large group.

A colleague and I recently discovered a massive security flaw in ESPN360.com’s browser checking functions. According to the website, you must have a particular cable provider, such as Adelphia, in order to use ESPN360. However, the page only uses a simple variable, affiliate, to determine whether or not your ISP is one that contracts with ESPN. This is easily visible via the source code, which shows a link of the following if you do not have the proper ISP: http://static.espn.go.com/broadband/ebb2/360SiteRedesignStaging/index9.html?affiliate=nonaffiliate

Now, anyone with a modicum of web programming experience will immediately plug the following into a browser: http://static.espn.go.com/broadband/ebb2/360SiteRedesignStaging/index9.html?affiliate=affiliate

Note here how we’ve changed the status from ‘nonaffiliate’ to ‘affiliate.’ This shouldn’t work. It couldn’t possibly work. But it does. That’s it. The entire check is a simple variable that you can pass through the URL.

I would like to point out that I do not advocate using this to receive a free service to which you are not entitled. I myself have a cable provider included on the list, but the ISP I use is separate and provided by work, meaning that it shows up as ‘nonaffiliate.’ As a subscriber to that cable provider (and their internet service at home), I am entitled to download the software there anyway. Finally, I have reported this flaw to ESPN360.com in order to allow them to fix it.

RE-Update: As of Wednesday, we found out that simply holding the ‘ctrl’ key while loading the link above avoids any and all of the security protections. Happy free online sports viewing (esp. the World Cup, boys and girls! Out-of-date-update: As of Monday night, ESPN updated their ESPN360.com page to run with Flash. I wrote an open letter to ESPN protesting the fact that I have to convince my ISP to buy something from ESPN. Read it and sign the petition here.
espn 360