Treat the network audio device discovery and connection UX like bluetooth

Background

From Fedora 43 onward, the PipeWire raop-discover module is enabled by default. It uses mDNS/DNS-SD (zeroconf, via Avahi) to discover network audio devices on the local network and automatically creates audio sink devices for them, which then appear in Plasma’s Sound settings.

Enabling this by default is a Fedora decision, not a KDE one. But I think it has illuminated a UX issue in Plasma itself: audio device discovery and connection are coupled into a single event. The moment a device is discovered, a sink is created for it and there’s no step where the user explicitly chooses which network devices the system actually connects to. When network discovery is on, everything advertised on the network becomes a live output.

The issue (including a privacy concern)

This coupling has a real implication for user privacy: audio including calls, text-to-speech and media can be output to a network device without the user’s consent. Automatic output switching to connected network audio output happens when physically connected audio output (line-out, HDMI, etc.) are unavailable, Eg. A user is watching a video with captions as they don’t have connected speakers. A network audio device can be auto-select for output so that audio end up on a stranger’s speaker without awareness of the user.

The reasonable user expectation is that audio output stays limited to physical outputs (line-out, HDMI, etc.) or to Bluetooth/network devices that user have explicity connected.

Proposed solution

Bluetooth already models this correctly. It has its own section in System Settings: you see nearby devices, you explicitly connect one, and only then does it appear as a device in the Sound section. Discovery and connection are separate steps, and connection is a deliberate user action.

Network audio devices should behave the same way: discovery populates a list of available devices, and turning one into an active output is an explicit connect action, with a matching disconnect. See it, connect it, audio starts; disconnect it, it stops. No surprise routing, no uninvited entries in the output list.

A broader question: a “Network Devices” section?

The same mDNS/DNS-SD protocol that discovers audio devices is also used for printers (AirPrint/IPP), casting, file shares, and more. They’re just distinguished by different zeroconf service types. So a natural question is where is the most logical place for people to discover network devices. A network devices sections for all device types might model the underlying protocol in the same way bluetooth devices are connected. However unlike bluetooth, these protocols for device discovery are branded in different ways. eg. airplay, chromecast, airprint, among non branded protocols. Should they be grouped by function eg. network audio devices, network printers? or even under their own sections eg. sounds, printers etc. where users might look for them first?

I’d raise this as an open question rather than the core ask, for one reason: these device classes are owned by different subsystems (audio by PipeWire/WirePlumber, printers by CUPS, and so on), so a unified panel would be an aggregator over several backends rather than one thing. Worth noting there’s precedent for the interaction itself — modern CUPS driverless printing already discovers printers via mDNS and only creates a queue on demand when you print, which is essentially this “discovered but not connected until used” model, in production today. So the pattern is proven; the open question is just how far to generalise the UI.

Scope / where the boundaries are

To be clear about which layer owns what: the decision to open a sink on discovery vs on demand lives below Plasma, in PipeWire/WirePlumber policy. What Plasma can own is the UI, surfacing discovered-but-unconnected devices and providing the connect/disconnect affordance that tells the layer below to open or tear down the sink. The ask isn’t for the Sound panel to do audio routing; it’s to expose an explicit connect/disconnect interaction over a list of available network audio devices.

Caveats I’m aware of

  • These protocols generally have no native “paired but idle” state the way Bluetooth does. Right now, creating the sink is what makes a device selectable at all, so a clean on-demand model probably needs the session manager to hold a placeholder and only open the real stream on selection.
  • Devices are often announced twice (IPv4 and IPv6), so any “available devices” list needs sensible de-duplication.

What I’m hoping to learn from this thread

  1. Does this fit how Plasma wants to handle audio devices, or does it belong somewhere I’m not thinking of?
  2. Is the right surface the existing Sound settings, a network-audio addition, or a broader Network Devices section?
  3. Has anyone already proposed or started something like this? I couldn’t find an existing request, but I may have missed it.

Keen to hear where I’ve got the layering wrong or where this collides with existing plans.

1 Like

I don’t think Plasma setups the audio sinks that’s lower level libraries, pipewire, wire-plumber.

That’s just AI generated, you can ask it to check more what it spits out, this is inaccurate.
Way too verbose for humans.

1 Like

Hey thanks for responding,
Sorry, to be clearer, I was talking about the UX and privacy issue of how network audio devices are currently handled. Why I have raised this here is because there may be an opportunity in how Plasma implements pipewire’s raop-discover auto sink creation and automatic output device switching. I do understand that Plasma is not responsible for these tools, It was more about how Pipewire or audio priorities/switching might be implement for a better UX and user privacy.

My thinking here was instead of passively enabling raop-discover, A Plasma module could instead implement discovery using avahi directly so that the user can be notified of discovered audio devices and can manually choose to connect or ignore the discovered device. It would also be good to be able to disable or remove devices that have previously been connected.
An alternative solution may be to set the device priority of network audio devices so that they must be manually selected?
I understand that this is balancing what might be a desirable feature - automatic device discovery with the friction of having to manually add them. I think the middle ground is notification for auto discovery, but with one click actions so that the user is in the look of the decision making.
See below for reference of others coming up against this issue.

1 Like

For my own use I’ve vibed up an initial package that solves this problem for me personally and how I expect audio devices connection to behave with a similar workflow to bluetooth. I’m adding it here as a reference prototype for the UX (I don’t suggest anyone use this unless they know whats going on in the source code). I feel this implementation ensures the user stays in full control of connected devices while still having a nice quality of life with desktop notification for network audio device discovery.
It required a daemon to handle the orchestration with avahi and pipewire and a seperate thin KCM module for the system settings gui.

1 Like

@jayel, are you willing to file a Bugzilla enhancement ticket for this? Obviously, do not utilise an LLM to author it. Otherwise, if you do, and link to it here, I shall support it:

Hey, yes I’m happy to file a bugzilla enhancement ticket though I think its worthy of more discussion about what the correct path forward looks like.

Having a fresh think through the issue again (its been a while):

Since airplay is roap, Its worth looking at how macOS handles it for both the UX and architecture.

The UX in macOS has discovered airplay/network audio devices visible alongside audio outputs in the taskbar menu but they sit as separate audio output category.

Under the hood macOS implements something similar to my daemon proposed above. While the UX makes them appear as just a separate group of available audio output devices, these devices are not yet sinks/virtual audio devices, instead the are populated by discovered network audio devices. Connecting to them is what triggers the sink creation.

Thinking about the UX of grouping of audio output devices also raises an alternative solution to user gating before sink creation which is to keep the existing raop-discover auto sink creation for everything on the network. Then have the user gate trust by the audio sink source. The default trusted audio sinks are those created by alsa (hardware devices) and bluez5 (paired bluetooth devices). Every other audio sink might be untrusted and is grouped selerately. This seperation allows for the existing auto output switching to only apply to trusted sinks. untrusted sinks can be connected to directly by the user, or they might be added to a trusted group to gain the same treatment as hardware/bluetooth output sources.

Essentially we want the user to be able to gate what network audio devices their computer treats as an available audio output device. The 2 implementations I see are

  • Gating before any network audio sink is created via a daemon that replaces raop-discover and handles discovery via avahi-daemon, user actions to connect, or trust (to memory) before creating the sink
  • Gating after untrusted audio sinks are auto-created with trusted/untrusted sink lists to stop automatic connections to untrusted sinks.

Both behaviours can map to the same UX whether its integrated into the Playback Devices view as a separate untrusted group, or as a seperate Network devices settings menu with Bluetooth ‘Pairing’ like model.

In a scenario like large organisational LAN, gating after sink creation still means pipewire is potentially creating a whole bunch of sinks on your computer that you didn’t ask for and presumably consumes resources?

Just letting raop-discover generate sinks and filtering after might be cheaper to implement. While its closer to the current implementation, I think don’t think its the best architectural solution.

It would be good to have a wider view of opinions about these proposed solutions. If filing a bug is the better place to resolve this detail. then I’m happy to move this discussion there?

1 Like

@jayel, I agree, with all potential problems. (This model certainly would not operate well in a secondary education LAN, wherein a child with a MacBook shall inevitably eventually create thousands of virtual ROAP devices, to spam everyone else!)

The ticket form allows you to enter your original grievance[s], and your proposed solution[s], beneath separate headings. Consequently, you are not bound to whatever you originally propose; a description of the problem is more valuable information for the triage owner.

There is a similar issue flagged

Thinking about it some more…
A key question is whether pipewire/wireplumber should be the one to provide a discovery interface without automatic sink creation bundled in? I think raop-discover is being opinionated on the kinds of environments it runs. For KDE to implement a daemon to interface with avahi seems like duplicating/maintaining code for the discovery half of what is a Pipewire/wireplumber concern.

It’s perhaps reasonable for KDE plasma to assume any sinks provided by the system are trusted. Though it would still be valuable for KDE to build support for interfacing with a theoretical pipewire/wireplumber discover only D-Bus API daemon and the existing raop.sink to create sinks for discovered devices.

Fedora turning on raop-discover from Fedora 43+ is perhaps the root cause. raop device support would be great but its obviously not ready for general desktop environment use.

So an issue across 3 projects, I think might be a tough one to get a resolution any time soon. I think the best first step would be for fedora to turn this off by default.

Oh, I forgot to mention what I think is a much more serious side affect of this issue:

It was sending wake calls and playing system sounds at full speaker volume to random speakers in my house at all hours, scaring sleeping children in the middle of the night!

This is an OS violating its permitted bounds. and because I had no idea at first that the computer was causing it. It took a few weeks to diagnose.