"Push to my OUYA" is a pull

Each game on the OUYA games website has a "Push to my OUYA" button on the top right. I wondered if it's really a push, or more a pull in technical terms.

Clicking it gives you - when logged in - the following message:

VLC MEDIA PLAYER FOR OUYA will start downloading to your OUYA within the next minutes

The text "within the next minutes" strongly suggest a pull. But let's have a look at the actual implementation.

Implementation​

Registration​

Clicking the push button on the website calls the following URL: https://www.ouya.tv/integration/remoteAccount.php?URI=org.videolan.vlc.betav7neon

This click event is tracked by Google analytics and optimizely.com, as OUYA tracks everything you do.

Push​

To get access to the OUYA console's actual network traffic, I set up a man-in-the-middle proxy like before.

Once mitmproxy was running, I could see the HTTP requests. Here is the "push" request from the console to the server:

GET https://devs.ouya.tv/api/v1/queued_downloads?auth_token=...
 
{
    "queue": [
        {
            "source": "gamer", 
            "uuid": "org.videolan.vlc.betav7neon"
        }
    ]
}

This URL is fetched every 5 minutes by the console, which explains the "within the next minutes" text. The OUYA-claimed push is actually pull.

I would have been really surprised if it was a push in every aspect.

Queue cleanup​

After OUYA found a game in the download queue, it fetches its meta data via a GET request on https://devs.ouya.tv/api/v1/apps/org.videolan.vlc.betav7neon?auth_token=...

If that worked, it adds the game to its internal queue and removes it from the queue on the server:

DELETE https://devs.ouya.tv/api/v1/queued_downloads/org.videolan.vlc.betav7neon?auth_token=...

Finally a popup is shown on the TV screen: