Skip to main content
paulrw
Prodigy II
July 9, 2024
Answered

Interesting read on how sonos is changing

 

https://www.linkedin.com/pulse/what-happened-sonos-app-technical-analysis-andy-pennell-wigwc/

 

What happened to the Sonos app? A technical analysis

 

 

Andy Pennell

Principal Software Engineer at Xbox, Microsoft

 

July 6, 2024

On May 7th, 2024, Sonos, the successful home-audio company, released a new mobile app. This had been hyped in the press and was going to make product setup easier and greatly improve the user experience. However, when the app was actually released, it was, and somewhat remains, a disaster. As a certified Sonos fanboy/hacker/almost-employee I'm going to try and explain what happened, as best I can based on my reverse engineering skills, honed over the last decade and more of creating independent Sonos apps.

How The "Old" App Worked

Sonos speakers have been the Gold-standard UPnP device since their creation. I remember around 2005 the lobby to Microsoft Building 50, which was the home of the Windows Media Division at that time, was completely full of boxes of Sonos devices. It was being used as the definitive test device for the engineers adding UPnP support to Windows.

Every Sonos device on the network (which nowadays can be Ethernet, Wifi or SonosNet, their proprietary wireless network) exposes many UPnP services in the standard way, and can be found via the SSDP discovery process. There are around 200 individual APIs exposed via their UPnP services, though you can write a fully functional Sonos app using less than half of them. UPnP calls are SOAP calls over TCP, sending and receiving xml. SSDP works via UDP broadcast and multicast. All of this works very well, the common problems customers have with device discovery (changing IP addresses, inability to route between 2.4GHz/5GHz devices) are usually solved by fixing router settings or, occasionally, replacing a router with something better.

Sonos devices also use an interface known as SMAPI to communicate with third party music services. This standardization means that the onus on adding a music service to a Sonos system is on the music provider, which has allowed Sonos to support over a hundred music services, something no-one else has come close to. The app uses SMAPI to find and enumerate music from a provider, and the speakers themselves use SMAPI to stream the music and share with other speakers in their group in real-time.

The SMAPI interface is reasonably well documented (well, it was until last year), but the Sonos UPnP APIs have never been openly documented. Fortunately, UPnP is a self-describing interface so any decent tool can show you the APIs and let you experiment - I use Intel's UPnP Spy to do this. As traffic is in the clear, network traces can reveal exactly how the app uses these APIs to find and playback music.

A third API set for Sonos is their cloud API: this has been around for around five years, and is somewhat documented. However it's never been rich enough to write a decent app: it was designed for music service integrators (think Spotify Direct), not app creators. It offers basic transport control but no way of enumerating music, unless you are also a music service provider.

How The "New" App "Works"

For the new app, Sonos threw out all of the old app code, a "clean slate" approach, replacing the front-end (the UX everyone loves to hate) and also the back-end (that actually communicates with speakers and music services).

Device Discovery

When the app starts, it must find your speakers as a critical precursor to anything else, but for some inexplicable reason they decided to drop SSDP and rely entirely on mDNS for device discovery. I don't know much about mDNS (as my own Sonos apps have never used it), but evidently this new way of finding speakers on the network has proven hugely problematic. My reading of how mDNS works is that it should suffer from similar problems to SSDP on routers that can't broadcast/multicast between radios, but it shouldn't offer new problems. But evidently it does: the huge amount of users who had perfectly working systems that suddenly had no devices found in the app shows that either mDNS is not a reliable discovery system on many home networks, or their code has some gigantic flaws. Me? I'm fine, my carefully-configured Ubquiti network has never had a problem with the new app finding my 15 Sonos devices. Others have not been so lucky, and right now, two months after the new app's release, something still stinks in the Sonos device discovery code, based on Facebook and Reddit anecdotal data.

App Performance

The old S1 app, which I am very familiar with (details later), used the native UX frameworks of the devices, ported to each platform. So Windows used WPF and the other platforms used whatever the "normal" UX frameworks were at the time. This gave solid experiences on all platforms, but obviously at substantial cost: every new feature in the UX had to be implemented in four different UX codebases. (The back-end was C/C++ and shared between all of them). For the new app, Sonos decided to use the same front-end on both mobile platforms so went with a Javascript framework (I try not to follow JS-UX-frameworks-du-jour so can't say which) so the UX code would only need writing once. (The Windows/Mac apps have been feature-frozen since the S1 split so no chance of their UX changing). I'm not sure how much of a performance impact the UX framework has on the app (that's not an area I know too much about), but a change that has clearly had a notable impact on app performance is the back-end change, moving away from UPnP.

Network traffic with the new app is all encrypted, so a definitive analysis will take me a lot more work and time. However, my most educated guess based on what I see in the traces is that the speakers now expose a version of the Sonos cloud API, but on the local network. In addition eventing, which used to be UPnP based (essentially you run a simple http server in the app and it gets calls from the speakers when an event is sent) is now based on a websocket.

As all traffic is now encrypted, it takes more CPU cycles for every network call: client encrypts it, sends it (TLS is a lot more chatty), and the speakers have to decrypt it before they can do anything. Even if the API was still UPnP under the hood (which I don't think it is), the crypto overhead is going to be a challenge on the older Sonos devices, which have tiny amounts of RAM (as low as 64MB compared to 8GB of the latest Sonos devices) with a similar disparity in CPU power. Also the cloud API is more "chatty" than the UPnP API, multiplying the network overhead.

The best example of how bad this can be is the Device Volume UX: in a group of, say, 8 speakers, you can pop up the device volume panel, which will show all 8 device volumes, along with the Group volume. (Group volume is a weighted average of every device volume). Users like to drag volume sliders all over the place, but in a Sonos group this generates a cacophony of volume-changed events: changing the group volume will change the volume on every device, and every device will send an event back declaring its new volume. As many volume changes can be generated per second with a user's finger, and the fact that the event ordering is not guaranteed, it takes great care to get this UX smooth and responsive. This is the one area of my own Sonos apps that I fear the most: I never want to change any of the volume UX code. Sonos even publish recommendations on how to deal with this problem at https://docs.sonos.com/docs/volume. Seemingly they did not follow their own advice with the new app's volume control, and the switch from UPnP events to websockets seems to have made things a lot worse.

The New User Interface

I'm not going to rant about this too much, I know from decades in the business that you can't please all the people all the time, especially when it comes to UX. Also glass houses: my apps have not been renown for their glorious UX. However I have an iPhone SE 3 and that means I only get a tiny amount of vertical space in the new app to select music, plus I hate sliding UX as the iPhone likes to pop its system UX up when I do this. I always use my own app to select music anyway, I love the huge 4K display on my PC.

Can it get better?

Sonos have been mostly in denial as to how bad things are, with the app release officially described as "courageous" - well, pissing off a sizable chunk of your existing user base could be called that, I guess. An immediate revert to the old version would have been my suggestion.

Also thanks to the device discovery problems, not only are existing users frustrated with the app not working, but new users who get their shiny Sonos device out of the box and then can't get the app to work are just going to put it back in the box and return it.

The new app shipped with a lot of features missing from the old app (never a good idea), but over the last two months some of those features have returned in various updates. However Queue management is still AWOL, and that was a key Sonos feature. (It's also a UX challenge, handling a list of over 30,000 items that can change at any time in a performant way).

While device discovery remains a crapshoot for many the app store scores are likely to stay in the 1.0 range that they have fallen to in the last two months.

Options

As many have discovered, the Sonos speakers themselves are still working fine, despite the contrary impression the new mobile apps may give. You can verify this by using the official Desktop apps (which are feature-frozen), or third party software like SonoPhone (for iOS https://apps.apple.com/us/app/sonophone-for-sonos/id815251931) or my own Phonos Universal (for Windows/Xbox https://apps.microsoft.com/detail/9nblggh4x6j0). All of these apps use the UPnP APIs, which still work great, for the moment anyway. However, Sonos have stated that they want to deprecate their desktop apps at some unspecific point in the future. If they do, they can then remove UPnP support from the speakers, killing the entire third-party ecosystem built around their products. That would be "courageous" indeed.

About Me

I've been a Sonos customer since the CR100/ZP100 released and been reverse engineering it since shortly after it arrived. My Sonos app for Windows Phone was one of the most successful employee-made paid apps in the store and had over 200,000 downloads. I worked with Sonos on Phish, the official Sonos app for Windows Phone 8 (never released). I was so impressed with Sonos engineering I applied for a job there and got an offer to join their Seattle office, but I declined, because reasons. I live in NetMon.

Views expressed here are my own, and not those of my employer, Microsoft Corp.

    This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.
    sigh
    sighAnswer
    Prodigy II
    August 2, 2024

    If someone had no discovery issues with the old app, but is having them with the new app, my gut feeling is that it is in the app side, but not necessarily that mDNS is failing.

    How and where the app is handling the overarching discovery process and dealing with responses from the local mDNS discovery and the api.ws.sonos.com request could be what is causing issues, rather than the local mDNS.

    The old app had 2 different behaviours depending whether you were logged into your Sonos account. Opening the app from closed to the System page

    When not logged in to the sonos account in the app:

    • it performs local discovery and shows the Sonos devices that respond

    When starting the app and logged into your sonos account 3 things happen in parallel:

    The responsiveness and what devices are shown with the logged in behaviour of the old app can be influenced by external issues when attempting to connect to the Sonos api during device discovery.

    Blocking *.sonos.com with a pi-hole or similar, then the discovery behaves similar to not being logged is just slightly slower because the pi-hole returns a NULL response to the api dns request which causes the app to give up the connection attempt and show the list of devices which responded locally.

    A slow request to the Sonos api, which could be anything from slow dns responses, overloaded internet connection, overloaded sonos servers, random other event somewhere on the internet, causes the app to keep showing grey placeholders until a timeout out is hit.
    When the timeout is hit it flashes an issue finding devices notification, then immediately displays all the locally found devices only. When the request eventually completes, or retries later, additional devices registered against the sonos household but not found through local discovery get added to the list.

    I simulated the above by overloading my pi-hole before starting the app. When the api call had reached a timeout (~10 sec I think) during discovery, it flashed an error notification, showed my 4 locally switched on speakers. When the pi-hole recovered before the usual default 30 second dns timeout a call completed and 3 speakers which have been unplugged for about a month, but still registered with my account, showed up as unavailable.

     

    Where it becomes tricky to identify what might actually be causing it, is that things have moved around in the new app. eg login in is now a requirement, the app doesn’t auto switch households based on local discovery, the new local search currently happens in a process which requires working internet (to be separated in a future update)

    While the discovery process may be similar, eg perform local discovery and call the api in parallel, it is likely wrapped in a different overarching app flow.
    How that reacts if there is an issue, such as the online call times out and/or has no response does it show nothing? What happens if there is a mismatch between locally discovered but registered devices and devices registered against the login account?

    Ideally the behaviour would be the same as the old app, but given the changes in making things like login mandatory, other things like the recently added Local Library search currently only work with an internet connection (to be fixed in the future) it wouldn’t be a surprise to find device discovery and display of devices has ended up shackled to online requests which don’t react well to unexpected behaviour.


    Something I found interesting about Airplay and the Apple TV is while it is still using bonjour as the primary discovery method, Apple have supplemented the bonjour discovery with Bluetooth LE discovery which sends out the Apple TV lan IP address. Over the many years they’ve been doing Airplay, maybe they found that adding the additional bluetooth discovery mechanism helped avoid issues in complex network setups, eg offices, and reduce home user issues due to random equipment either supplied by an ISP or it was the cheapest/store/online recommended item.

     

    View in thread

    92 replies

    Show previous replies
    Stanley_4
    Stanley_4
    Grand Maestro
    July 13, 2024

    Something I thought of after my post above, Sonos could also push a firmware update that would make the previous controller versions less functional. That happens already as with my old android tablet that has been an alarm clock / Sonos controller for some time now. It does still do the basics but most functionality is disabled, requiring a newer device and software.

    chambolle
    Enthusiast II
    July 13, 2024

    I have no problem with the fact that Sonos wants and needs to protect its intellectual property. But there is a problem when Sonos force-feeds users with software that does not work for them; and then declines to respond to entreaties to fix it. Evidently there is a reasonably simple solution to one of the major problems that came with the ‘upgrade’ of S2: loss of access to Sonos playlists that are the tool many thousands of us use to listen to music which we ‘archived.’ Which makes one wonder whether there is an undisclosed reason Sonos hasn’t provided us with a solution or even promised to provide one as part of its ongoing ‘update’ process.

    If it’s Sonos’ intent to deny access to our playlists as part of its future business plan, it behooves Sonos to candidly advise us of that fact, rather than simply ignore the many users who want to know whether and when we will regain access, along with the ability to edit existing playlists and save new ones.

    Once we know what Sonos intends, we can exercise our option to stay with Sonos or go. Right now I’m staying because I’ve regained - with help from a 3rd party app — what was for me a key music playback function. I’m not staying if Sonos takes steps to disable that function for its own business reasons. 

     

     

      sigh
      sigh
      Prodigy II
      July 13, 2024

      I’m pretty sure that the Sonos devices check the digital signature on any file you try to load. Faking that is about impossible.

      Hi @Stanley_4, one imagines that Sonos devices “call home” for any firmware update. While one never know with anything running Linux, I’d be surprised if there was any path to sideloading. So I agree with you 100% that any firmware install requires the full support of Sonos.

      As noted in my post above, it seems to me that the existing v16.2 firmware would be a copacetic choice for a would be Don Quixote.

      Sonos devices have had a locked bootloader for many years now. Unless an option is made available by Sonos for end users to request a bootloader unlock and give up all warranty, Sonos Online Platform integration and support from Sonos, then I don’t really see a jailbreak or sideload option being viable.

      Over the years people have looked at the hardware and firmware, decoded it, made their limited progress publicly available, but the reality is the effort involved isn’t worth it when there are alternative hardware options available at more reasonable prices for music playback.

      Any calling home could be blocked or redirected, but without an easy way to unlock the bootloader and install an alternative firmware it’s pretty irrelevant.

      Security companies who find exploits and perform responsible disclosure with Sonos have had mixed results with Sonos. Sonos usually patch the firmwares based off their disclosure, but rarely provide any public disclosure or raise CVEs themselves and the patches will be hidden in the magic bucket of ‘Bug fixes and improvements’ on the release notes. They prefer the old security via obscurity approach than openness adopted by modern companies and that is unlikely to change without an exec level change.

      https://tnpitsecurity.com/blog/gaining-root-on-sonos-speakers/
      https://research.nccgroup.com/2023/12/04/shooting-yourself-in-the-flags-jailbreaking-the-sonos-era-100/

       

        AjTrek1
        AjTrek1
        July 13, 2024

        I just don’t see Sonos allowing a Sonos the Way it Was OS version. Here’s another real life case of a failed attempt to allow clones that resulted in financial crisis.

        Xerox at one time back in the early 80’s manufactured copiers for a competitor. The agreement was to use identical Xerox machines branded with the competitors logo. 

        At that time copiers were sold by boots-on-the -ground sales reps. The agreement between Xerox and the competitor further stipulated that the competitors sales force could not inform their clients that their machines were identical to Xerox machines just with their competitive  branding. Well, as you can image that worked quite well…NOT! If the competitors sales force was about to lose to a Xerox sales rep selling the identical machine the competitor spilled the beans to secure the sale.

        Xerox at the time basically told their sales force to work harder to sell their branded gear. Xerox corporate didn‘t care because the copiers built for the competitor were already considered revenue earned. Xerox saw that arrangement as a win/win as the competitor still had to buy Xerox toners which was another revenue stream.

        Well…fast forward and Xerox finally realized that their customer base was shrinking because of the arrangement. So what seemed like a good idea in the beginning soon became an albatross. 

        IMO Sonos could fall into the same quagmire if they allowed a Sonos the Way it Was version of their OS. I’m not saying that the idea has no merit…just that it doesn’t IMO in the long run make good business sense.

        Together Everyone Achieves More = T.E.A.M.
        sigh
        sigh
        Prodigy II
        July 13, 2024

        I just don’t see Sonos allowing a Sonos the Way it Was OS version. Here’s another real life case of a failed attempt to allow clones that resulted in financial crisis.

        Xerox at one time back in the early 80’s manufactured copiers for a competitor. The agreement was to use identical Xerox machines branded with the competitors logo. 

        At that time copiers were sold by boots-on-the -ground sales reps. The agreement between Xerox and the competitor further stipulated that the competitors sales force could not inform their clients that their machines were identical to Xerox machines just with their competitive  branding. Well, as you can image that worked quite well…NOT! If the competitors sales force was about to lose to a Xerox sales rep selling the identical machine the competitor spilled the beans to secure the sale.

        Xerox at the time basically told their sales force to work harder to sell their branded gear. Xerox corporate didn‘t care because the copiers built for the competitor were already considered revenue earned. Xerox saw that arrangement as a win/win as the competitor still had to buy Xerox toners which was another revenue stream.

        Well…fast forward and Xerox finally realized that their customer base was shrinking because of the arrangement. So what seemed like a good idea in the beginning soon became an albatross. 

        IMO Sonos could fall into the same quagmire if they allowed a Sonos the Way it Was version of their OS. I’m not saying that the idea has no merit…just that it doesn’t IMO in the long run make good business sense.

        Sonos actually already provide one… it’s called S1.

        The only thing stopping Sonos doing the same with S2 and having the new one as S3 is Sonos themselves. It is possible they considered it and decided the S1/S2 debacle was too much to go through again 🤷

        Will Sonos endorse an alternative OS on their devices or unlock the bootloader for their own devices? Not a chance. Originally, when first released and focussed on local music playback, they had an unlocked bootloader. No chance of that now as their 3rd party streamings contracts would disappear overnight if people could modify the Sonos provided firmware easily.

        The best anyone could possibly hope for would be for Sonos to white label and license the tech platform to other companies who could brand and develop their own controller apps, but unless they want to become a platform/api provider, and get out the hardware side, then no chance of that either.

        The hardware only revenue side of Sonos is actually a problem they need to solve because purely selling hardware to pay for continued support, software development and running large scale online services isn’t realistic. 

          AjTrek1
          AjTrek1
          July 13, 2024

          S1 is significantly watered down receiving no updates. The original post is suggesting a fully functional OS that also serves current and future products… to my understanding.

          Together Everyone Achieves More = T.E.A.M.
          controlav
          controlav
          Lead Maestro
          July 13, 2024

          S1 is significantly watered down receiving no updates. The original post is suggesting a fully functional OS that also serves current and future products… to my understanding.

          The only real new feature that S2 has over S1 is lossless playback. (Well and newer hardware support, along with SMBv2/3).

          It’s a pretty good choice for Sonos The Way It Was.

          Author of the leading independent Sonos apps for Android, MacOS, iOS, Windows and Xbox.
            sjw
            Local Superstar
            July 13, 2024

            Functionally, there's still almost no difference to S1 and S2 all these years later. Groups and not much more really. You STILL can't multi-select items in a list to add/move/remove…

            The Desktop controller remains way more efficient for so many tasks.

            buzz
            buzz
            Grand Maestro
            July 13, 2024

            I prefer the desktop controller because everything is presented, rather than forcing me to scroll and dig for everything. As I watch younger computer/phone/pad users I find that they prefer sparse screens because that seems “easy”. I also think that they enjoy scrolling and drop downs. For me this constant need for digging is “complicated”.

              AjTrek1
              AjTrek1
              July 13, 2024

              OK…we’re all just throwing things at the wall to see what sticks. But I ask you…what company has their proprietary software being used by a 3rd party to circumvent the use of their software to lend functionality to the proprietary companies product. BTW… Open Source and Android which is owned by parent company Alphabet can’t be used as examples 😊 You have 60 seconds 😂

              Together Everyone Achieves More = T.E.A.M.
              Show more replies
              Terms & ConditionsAccessibility statement