2026-10-04: So I Looked at altstream.online
I was a big supporter of Altair when they were getting their crap together. I'm desperate for something to go toe to toe with Twitch that isn't going to just turn around and start treating streamers like some kind of homogenized cash mill. I just want to play games and chat with people; I've been doing it less and less due to burnout and just because every time I start a stream there's some new shitty thing to turn off (if I can turn it off). It's a lot on my constantly strained mental health.
Altair disappeared and took the crowdfund money with them in some kind of weird Spiderman Pointing Meme of blame between them and their payment escrow. I still don't know what happened. Someone made the medium bucks and we got no streaming service. I got left pretty bitter and did a bunch of math that says running a streaming service if you're not already a billionaire-run giga-corp is not feasible. It comes to the tune of "A couple cents per viewer-hour, depending on bitrate; and that adds up to a lot"
That colors my perceptions a lot and I assume anything claiming to be a Twitch killer is lying.... somehow. So when someone started posting on fedi about "A new Twitch killer" I kind of, let's say, doubted it.
So altstream.online! They don't claim to be a Twitch competitor, and they're certainly not. I am at the least convinced they're legit; which on its own was a pretty high barrier to cross given every time someone shows up with a new service we find a hook sooner or later. They're past the point of Altair where Altair made promises and didn't deliver a darn thing at least. But I'm helplessly curious and I went poking at their backend. You can learn a lot just from passively observing traffic after all.
I'm going to spoil this up front since I have a tendency to get lost in the sauce and people misunderstand: I found multiple bad things; some that made me extremely suspicious of what was going on. And then I actually talked to people and found most or all of them have an explanation or are the result of being fed bad expectations by people desperate for a Twitch competitor.
I'm also going to spoil: my full feeling on the site after coming away from it all and talking to those people is positive but with tempered expectations.
Passively Observing the Shape Of an Infrastructure
I rather quickly realized they're using WebRTC for their low latency transit, which already narrows the list of candidates for the tech they're using. It also means you get a lot of neat tools for inspecting streams built right into the browser. There's a lot of stuff here about SDPs and peer negotiation and STUN and ... just a whole lot of stuff you can get to get a general idea of the shape of a WebRTC infrastructure!
Let's start with the big nasty thing: altstream.online is, at the time of this writing, one server somewhere in the rough area of the UK or western Europe, hosted in Oracle Cloud or a reseller of Oracle Cloud. Now, with my own experience setting up restream.space, I know a single ~2GHz core can typically carry about 10 streams in or about 70 out. Bitrate and ratio matters here. Point is, that's not a whole lot for a streaming service that's generally available! Let's say they're doing a two core offering and can support about 150 viewers.
Surprisingly yeah, it's CPU that's usually the problem not bandwidth even if you're not offering transcodes (which they are not). To be fair I'm using one specific software offering and maybe others are more efficient.
Anyway I point this out first to get the big expectation out of the way: They're not going to be a Twitch killer. They're not even claiming to be. People saying that are more than likely doing them a disservice by setting incorrect expectations. They also plan to expand; how they plan to do this I'll be curious to see. I had to kind of flail and make up my own scaling as I went when using OvenMediaEngine because that software only wants to do Origin-Edge and not mesh clustering. I had to find an unsupported way to make it do mesh and it's probably Bad.
They're also using UDP and I chickened out of that and resorted to using a STUN server and TCP for everything because I kept observing delivery problems, at least in the US internet state of things. This has its own drawbacks; you kind of pick your poison on this one. They do have fallback to other transit options like FLV and HLS so if your connection is shoddy you're not just left out in the cold; I don't have that but my use-case is different. "Just use UDP and use an entirely different protocol for fallback" is a better option. If I wasn't running restream.space on a shoestring budget of $5/mo VPSes I'd consider it!
A Little Less Passive, A Little More "Uh Oh..."
At this point by observing their use of WebRTC and HLS and such I got curious. I saw behavioral flags that made me believe they were using OvenMediaEngine as a backend. I have experience with OME having uh... security issues... let's say. So I went to look if I was right and those were present. The main issue is OME had no concept of API security for many major versions. Oh sure it claims to, but if you actually try it'll let you in. I poked known API ports.
It's not running OvenMediaEngine. It's running SRS.
SRS is kind of an old duck in this pond. They've been building something shaped like a media transit server for 12 years now? Something like that? Recently however they went full on into slop and are billing themselves as "An AI driven media server"; oh gods. I felt a migraine flare up when I started reading their pitch. If you're about to go "Oh slop" and close the tab, don't. Bear with me for a bit; or at least skip to the end where I tl;dr summarize.
Even OME, which I use, is on this trend of slowly sinking into the AI bog. It's why I've only been backporting security fixes for awhile... sigh. So I mostly left this as "Well it's a choice from a limited pool of bad choices".
At this point I'm firing a stream of consciousness liveblog of my poking into socials. Probably a mistake-- definitely a mistake. I go "Aw damnit" at this, but like I said: it's not necessarily a reflection on the devs. Or I guess dev as I found out.
As they say though: but wait, there's more! How I found out they're using SRS: what I thought was an API port didn't have an API on it when I actually probed it. It had a stats and administrative panel. Open to the internet. Hell at first I thought it was some demo, or a test, or something. It's SRS's inbuilt stats and info stuff, and reported no transit in use on its main page. I kind of shifted into "Uhhhh maybe I should tell someone about this" mode and looked to verify if it was real. I was able to do so by poking vhost settings, stream lists, etc. I could get a couple nasty things you don't want leaking on the public internet. That was enough for me; I didn't check if I could alter configs or do something truly grotesque like kill the server.
I think my exact words in the thread I was posting was "Oh gods, I need to make a security disclosure :/"
I deleted most of the thread. A couple of people were accusing me of fear-mongering and "being extremely weird in how I PSAed this" anyway. As if it was a PSA; I was just talking to the void about what I was looking at. Sigh. Social media...
So I Go To Report This...
Something about me: I hate discord. If you tell me "Join our discord to do this", I give up 99.99999% of the time. Altstream said "Join our discord to report issues". Ah crap.
It's probably a testament of how much I believed at this point there was actually A Thing With Potential here that I pushed through that distaste and anxiety. I got a weird vetting wall; something I didn't know Discord could even do. I was being held for review before being allowed to join and even talk to anyone.
Gonna be honest, this frustrated me, a lot. I was now on the hook having said "Hi I have a security disclosure" and was now being left on read for an unknown period of time. If my anxiety won out and I bailed would I be blamed? If I went to bed (It was 2am at this point), would I wake up to some panicked staffer yelling at me in DMs about why I'm not telling them the problem? I added "And I can't even make a security disclosure to them" to the list of frustrations I'd experienced exploring their infrastructure and left an omnibus post of what's "off" about all this on fedi.
Around here someone got back to me. I was expecting some slick startup engineer type because that's what I got when I tried to talk to Altair. I didn't get that. What I got could be roughly summarized like this:
What's up (regarding you joining to say you have a security disclosure)?
Your stats/admin panel is exposed to the internet.
Ah. We'll fix that in a little bit.
They had it fixed within a couple hours of my discovery of it, most of that time spent waiting for someone to be awake to read my disclosure. Mainly though this was a very human conversation. I expected some community manager who didn't know what I was talking about, or some snowjob about "Oh that is intended behavior" from someone who didn't know squat. I got the opposite; I was actually taken aback by this.
Because this conversation was part of a "Join application" or whatever, I got let in the Discord. I actually didn't want this initially. I wanted to drop this little nugget, put on my sunglasses, peel out in their driveway and hopefully not create a cloud of smoke that dissipated and revealed me dead on the pavement (h/t to dril). I stuck around though because this is the only way I found out my perception of their team was dead wrong.
And Wrong It Was
Altair colored my perceptions, as has my studies into the financial viability of running a streaming service. I've come to expect if you reach GA you've probably had to have some person in a suit lecture you on the finances and generally put a polished shiny face on what you're offering.
Here's the thing though... and it's something I've learned multiple times in my time online too: you can build something, not intend for it to become GA, and someone pushes you to general availability for you. That kind of happened here.
"There is no person in a suit doing all of this wetwork that manifests as a gross slimy silicon valley startup feeling" is a double-edged sword. I find it quite refreshing, but also I'm not sure "We ask for donations" is a sustainable plan for this. Time will tell; I'm a lot more comfortable with and confident in having it this way than the alternative. There's three people and some other volunteers maybe. At the very least they seem to have an operational expert so I've put my SRE-shaped screaming away for the time being.
The exposed internal panel? Yeah that sucks, but I can't say I've never made that mistake before. restream.space had an exposed API port with broken privilege modeling on it for about 3 months before I realized it. It also had a stream key takeover race condition I discovered and fixed two months ago. RS has been up... gods... 3 years now? It's powered a dozen events with those holes in it.
More importantly, they seem receptive to even my somewhat brusque form of feedback. Usually in something like this, a community develops that insulates against feedback and concerns. I found out the person who approached me when I went "Uhhhh folks? Problem?" was their operational lead. I've since then directly talked to their dev and another person showed up in the remnants of the social media thread to thank me for pointing things out. So while I'm not a fan of having to join a Discord to raise any kind of anything to the staff, I get why; and they're pretty transparent and responsive once you are there.
You Never Delete Things On The Internet
I said once I discovered that little exposed admin page, I deleted most of my posts on it and said I'd wait til I talked that out to say more. Well nothing is truly deleted online; especially on Mastodon/fedi/whatever.
I woke up this morning to a user who screenshotted (screenshat? Eh that has a bad mouthfeel) my original post and posted it in the Discord, where I was, and had just been offering to help with my insights on WebRTC and clustering and infrastructure. So I got to wake up to people commentating on that like I wasn't there.
If you know about my little pen name alternate project "being talked about like I wasn't there" could be hot to me, but not in this context... Bad lewd joke, sorry. You'll be getting those more for Reasons.
Fortunately I run my own fedi instance and just re-sent the damn deletion activity, not that it's guaranteed to take this time either... sigh.
I kind of ate crow on that one; there was a reason I stopped posting, deleted most of it, and decided to wait and see. Unfortunately, internet. For the most part if someone is passing screenshots around of crap I said while delving into all of this now, this post supersedes all of that.
The one staff member I hadn't spoken to up to that point actually defended me on that. I'm appreciative but yeah, I can definitely see "My tone was off by about a parsec" in the original stuff. I was still convinced this was a grift somehow.
Having sat around for awhile and watched discussions (including one about the stuff I wrote, while I was asleep) I'm quite convinced this is a legit passion project that is growing out of scope and they're planning on how to handle that. That's a sharp contrast to my original perspective which was "Startup culture and possibly a scam", and a lot of that perception was colored by incorrect signaling from people trying to promote altstream as a Twitch competitor. It's not.
You Don't Need to Be a Twitch Killer
I asked this question to my friend group last night over voice: how ready to fight Twitch do you have to be before you GA? The most direct answer is you don't have to be at all, but it's not that simple. Any streaming service that shows up is going to weather a migration hit from people desperate to do anything that isn't Twitch or Youtube.
Ages ago, you had Hitbox. Hitbox was the alternative to Twitch, but it was kind of crap. It was crap not because it was crap but because any time anyone thought about Hitbox, it was when Twitch was doing something dirty. When Twitch was doing something dirty, Hitbox's traffic spiked about ten to twenty fold and it became crap.
When I opened altstream the first time, I first noticed an extremely bad delivery quality. That was because a bunch of people were trying it. Remember what I said about its low viewer cap due to being one server? They were running pretty close to those figures. Later at night when it was just a couple people, it got smoother. Same concept as Hitbox, lower thresholds. However, part of existence in this state of "We're just here with a narrow purpose" is any time Twitch makes a bad announcement, you're probably going to go down for a bit due to migration spikes.
This happens, or happened, on fedi in the waning days of Twitter. About once a quarter half the instances would go down to a massive traffic spike of new people landing from Twitter, looking around, eventually leaving. Ultimately these spikes self-correct as the rocky delivery quality means less invested people leave. It's not a good way to manage your service loads, but it exists and is more a fact of life than a growth strategy.
"Invested" is a key interesting word here. I think altstream wants to cater to people invested in the idea of streaming somewhere more human-oriented. Not AI, not traffic, not viewers, and not money. This will already exclude a lot of people, and not necessarily all big streamers who'd try to bring 4000 viewers who then complain they can't post animated GIFs or start hype trains or whatever Twitch has going on now. You need a certain mindset to weather these early technical challenges, and that mindset is "I value a more intimate, person-centric platform more than I value growth, viewercount, and tips/donations/subs"
That sounds good to me, but it won't to everyone.
It's worthy of note again that they are talking about expanding. I offered insight into what I figured out when I had to expand restream.space from one server in California to half a dozen globally distributed nodes, but even my approach may not scale to what they're building. I think for the immediate term I've carried more streams at once than altstream has, but it won't be that way for long.
It's part of why I limited my scope to "I carry event video transit and let Twitch worry about the viewer-facing business"; when I sat down and did the math it didn't work for me. I hope they've done the math and it works for them.
I'm also bad at math though.
But That AI Thing!
Okay look. I was originally pretty put off by their use of SRS. I'm as anti-AI as it gets. I frequently say "If you release something that's touched slop you didn't release anything at all". Three things here:
- SRS has been around far longer than AI has and it looks like they pivoted into this absolute BS recently. Hell altstream could have been in the process of being built when they made that change.
- There are not really good options that don't. Even what I use is embracing AI. My options are pretty much rebuild my everything from scratch and hope something like Ant doesn't do this, or grit my teeth and bear it for now while I figure out another choice. I don't have time to do the former; I'm supposed to be resting from my past 9 months of event running as it is.
- When they found out, they said they'd replace SRS. They didn't know.
Considering I cannot commit to replacing my entire service's video transit backend in the same situation, I can't throw stones here, they're taking a higher road than I am. Sure OME isn't AI first like SRS is, but they are AI something. Gross.
Frankly I wouldn't even know what they were using if not for that little oopsie with their exposed admin panel. I could find out by comparing SDP formats I'm sure but that was beyond the effort I was willing to go to.
That's A Lot of Words, Where Are We?
Trying to fit a summary into a hecking tweet or whatever is what got me in this trouble to begin with; let's see...
I think a summary I sent to a streamer friend puts it best: They're genuine and built something for a smaller use-case that is blowing up and now they're trying to figure out exactly what they're capable of doing, and made a couple mistakes along the way so far. That people are making promises in their stead that don't even fit their mission is not helping.
I certainly went in expecting Altair-tier promises and were given those by other people. They never made them themselves. It's three people and a smattering of help from others, one server (but soon to be more probably), and whitelabel FOSS video transit software. They're probably never going to be able to afford universally available transcodes, they're using the same "cheat" I am of piping streamer output directly the viewers to reduce costs, and they're probably going to fall down any time there's an influx from Twitch doing something shitty.
The little security thing sucked and was scary to see but they fixed that quickly. I don't know what more there is to say on that. As I understand it they even stood up a security disclosure inbox after that so no one has to sit through the Discord vetting to warn them of something in the future.
When they found out SRS is slop, they said they were going to replace it. Like I said, I'm not capable of doing that with OME in my stuff and OME is similarly slowly tilting into AI commits and whatnot. I can't judge on any basis of "It shouldn't have happened to begin with" or anything like that.
I've done the math for my use-cases and plans and I'm worried, but if they keep their footprint small it's workable to run on donations. I still napkin math "3-5 cents US per viewer-hour, depending on a lot of factors". I saw someone with 20 viewers last night; in a four hour stream they probably cost altstream about $3. That's one stream. I think some mindfulness about the cost you generate, and chipping in if you can, is pretty important for something like this.
I think that lands on what I'm trying to say: this needs people who would look at it less as a service to move to, and more as a cooperative to participate in. They're going to need donations if they intend to avoid ads and other creepy monetization. Carrying an average stream could cost them a couple of bucks per stream if my very myopic math for my use-case applies to them. They need people with a cooperative mindset just as much as people need to go in with that expectation.
And it's going to be rough as they figure stuff out.
But everything I was worried about? They handled and handled well. Maybe don't trust moving your everything there right away, but I think it's worth a try.