6 ms·

On Botnets and Streaming Music Services

120 points by 6stringmerc 11y ago

ChuckMcM 11y ago
I wondered about this, I figured someone had figured out they could use pretty standard click fraud techniques to milk money out of the pay-per-play ecosystem. No doubt someone in operations over at Spotify spends their nights trying to detect these kinds of patterns. It would be interesting to hear their take on it.
- 6stringmerc 11y ago
  Agreed! Considering how much discussion there has been regarding transparency in the music business - the leak of confidential information via the Sony hack being one of the few instances where numbers are exposed - I think this could be a viable avenue for Spotify to make their case better to artists. Also, I'd hope it's one of the few areas where Spotify and other services can legitimately have "free reign" to discuss their operations without being handcuffed by non-disclosure clauses in contracts.
hiou 11y ago
I feel like the writer of this article has a fundamental misunderstanding of Spotify's business model. The number of plays influences how much money Spotify brings in from advertisements. As far as they are concerned fake and real plays are not much different beyond maintaining credibility with their advertisers.
- forrestthewoods 11y ago
  "beyond maintaining credibility with their advertisers" This may come as a surprise to you, but advertisers are deeply concerned with click-fraud and impression reliability/value. So it's not important to Spotify... except for this one reason that actually makes it super important.
  - hiou 11y ago
    Right, that is exactly what I said. I feel like you misunderstood my comment.
    - ZoF 11y ago
      I feel like you're misunderstanding the situation to be honest... >As far as they are concerned fake and real plays are not much different This is flagrantly false given that they do care whether plays are legitimate because they do want to be able to verify with advertisers that plays are served to credible clients... Are you implying that Spotify would expect that advertisers are stupid/inept enough to not notice when a large number of ads are served to fake/bot consumers? Spotify as a company has the prerogative of acting with integrity in these situations if only for future maintainability/acquisition of relationships with advertisers. Even if an advertiser was inept enough to not notice their ads were served largely to bots the value of those ads would still ultimately be lowered by them being served to bots. e.g. if 1000 ads are served and 500 are sent to bots, the overall value of each clicked ad is eventually lowered by 50%. This is assuming an advertiser is so inept they aren't measuring clicks per served ad, which doesn't even occur. I think you're fundamentally misunderstanding why spotify _does_ have to maintain the credibility of those ad clicks/listens/etc...
      - hiou 11y ago
        > As far as they are concerned fake and real plays are not much different beyond maintaining credibility with their advertisers. No real desire to argue the semantics of what I wrote. This is bizarre. Anyhow, the difference is that one situation is an issue of perception and the other is of actual fraud. Not sure why you think perception and reality are identical things.
        ZoF 11y ago
        What? Botnets 'listening' or 'streaming' is fraud. That it's not immediately identified is obviously not an issue. E.g spotify isn't affected by the fact that the steps outlined in this post occurred. They are however affected by the fact that this is possible on a larger scale. The post has demonstrated that the cost of server time for generating 'listens' is less than the amount of royalties paid out. Therefore any artist with the appropriate technical ability could code up a botnet that generates him more revenue then he is spending whilst having literally 0 legitimate fans/listeners. Are you seriously not able to understand why this is an issue? Yes; In isolation, this singular post isn't a problem. But when freemoneyforbadmusic.ru pops up offering 10000000 listens for 5$ spotify will have a real problem. What are you not understanding about this? There's nothing really semantically wrong with what you've said. It's just factually incorrect.
- acgourley 11y ago
  Spotify very much cares - Advertisers ultimately will measure clicks and if listens increase without clicks increasing, the payout from ads will drop.
deleted 11y ago
[deleted]
SeanAnderson 11y ago
(I misread. It's 8/100th of a cent. Much more realistic.) Artists on Spotify earn 8 cents each time their song is played? That figure seems really, really high to me. I'm not especially surprised this is possible, but it comes as a huge shock that it would be financially profitable for someone. A quick glance at some other articles (http://www.theguardian.com/technology/2015/apr/03/how-much-musicians-make-spotify-itunes-youtube http://www.theguardian.com/technology/2015/apr/03/how-much-m...) shows drastically different figures: "For example, Spotify says that its average payout for a stream to labels and publishers is between $0.006 and $0.0084 but Information Is Beautiful suggests that the average payment to an artist from the label portion of that is $0.001128 – this being what a signed artist receives after the label's share." This would make it much more expensive to run a botnet through AWS than any potential profits it could generate. Some other thoughts after reading more closely: - It's surprising that the minimum listen time required for payout is 30 seconds when average song length is 3 minutes (or even higher? A reported 3m 45s: http://www.statcrunch.com/5.0/viewreport.php?reportid=28647&groupid=948 http://www.statcrunch.com/5.0/viewreport.php?reportid=28647&...). Is listening to 3/18th of a song really enough to warrant payout? Maybe. - The opening sentence isn't all that truthful. It's implying that an average user is just going to open Spotify, mute it, and go to sleep. That means they won't be there to skip every 30 seconds. So, we fall back to the 3 minute average. Assuming you sleep for 8 hours that means you're only going to get 160 plays or ~12 cents not 72.
- michael_fine 11y ago
  artists’ take for ad-supported listeners was **0.08** cents per song Actually, it's 8 hundredths of a cent per song, which is more in line with other sources on that.
- azeirah 11y ago
  You misread it, it says "was 0.08 cents per song", that's 8/100th of a cent, not 8/100th of a dollar
  - SeanAnderson 11y ago
    Ahhh, okay. My mistake. That makes more sense.
mootothemax 11y ago
Isn't there potential here for a much more nefarious plan than merely earning revenue from fake listens? If you could do the same thing across a few services, spreading the number listens out on a viral pattern, based on a bit of investment in highly marketable songs, it sounds like you could create a bedroom-singer rags-to-riches superstar story and potentially make millions upon millions.
- 6stringmerc 11y ago
  Yes, I think you're on point with how the exploit could work. Just as reference, I do think the notion of "payola" is similar in practice - using avenues to represent an organic growth of interest, but achieved through alternate means.
- paulasmuth 11y ago
  A similar thing has happened in the past: >> "Gracia was selected to represented [sic] Germany in the Eurovision Song Contest with the song "Run & Hide", produced and composed by David Brandes. After the German national pre-selection for the Eurovision Song Contest it was revealed that Brandes had bought thousands of his own CDs to ensure chart placement, a requirement of the ESC" https://en.wikipedia.org/wiki/Gracia_Baur https://en.wikipedia.org/wiki/Gracia_Baur
  - mahouse 11y ago
    Instead of that pedantic "sic" you could have, you know, fixed the article.
    - thedufer 11y ago
      Can you really call it a direct wrote at that point? [sic] is an accepted way to avoid integrity issues when quoting.
  - nommm-nommm 11y ago
    Oh this is a common way to get on the NY Times Bestsellers List. https://en.wikipedia.org/wiki/The_New_York_Times_Best_Seller_list https://en.wikipedia.org/wiki/The_New_York_Times_Best_Seller...
dontreact 11y ago
This seems to be another argument in favor of the model proposed here: https://news.ycombinator.com/item?id=9226497 https://news.ycombinator.com/item?id=9226497 Split revenue per individual amongst artists, instead of splitting total revenue amongst artists.
13thLetter 11y ago
The takeaway I'm getting from this is, as with other websites, the attempt to fund streaming music indirectly via targeted advertising is hopelessly unable to keep up with ever-more-clever click fraud. At best, we end up with an arms race of more and more powerful "criminal" botnets and more and more heavyweight advertising tech crowding out the original content. I'm becoming very sympathetic to the viewpoint of backing out towards either completely untargeted advertising (which, paradoxically, can be far more effective) or -- and, admittedly, I'm going crazy out on a limb here -- paying for content.
- ianlevesque 11y ago
  Paying for content worked great until the middle class collapsed.
  - krschultz 11y ago
    s/middle class collapsed/broadband became prevalent/
    - 6stringmerc 11y ago
      "What do you mean people can use their computers to listen to music and copy things infinitely? There's no money in that! We should try and kill this Napster thing to protect selling CDs for $20 a pop and never support online distribution no matter the customer demand!" - The Music Industry (paraphrased for sarcastic effect)
      - cwyers 11y ago
        And... were they wrong?
        6stringmerc 11y ago
        That depends! Are you on the side of Cliff Burton era Metallica as a band that encouraged tape trading as an avenue for exposure, or are you on the side of Lars Ulrich era Metallica that feels people sharing music without paying money are enemies of the band? If you believe in the latter, then that's a perfectly reasonable position for record labels and publishers who invest in "startup" acts hoping they get enough ROI to cover the failures, and then give the successful bands only what they're contractually owed after recouping. Sure, that's a business model. The only number that matters is the number of people paying for the recording. If you're in the camp of the former, you might think that organic growth and demand for your supply means getting to hit as many ears as possible is a chance to broaden the base of people willing to pay for more. Just because somebody can get a recording for free doesn't mean they aren't interested in giving you money for a live show or a t-shirt or a sticker. The bigger the fan base, the better the income potential. I'm going to assume you didn't live through the same era that I did, when Napster was more prevalent in dorm rooms than illegal booze. After that window got slammed shut, the industry narrative (backed by an ignorant Judge's opinion that "the computer is not an audio device") was that anybody who didn't buy retail was a criminal. Ever buy a used CD? That was another target. There was a huge opportunity to embrace technological evolution. Not until Steve Jobs and iTunes worked out the mechanics of DRM and "buying a license" did the industry decide to get on board. It seemed like the industry had their cake and could eat it too...until Eminem looked at his contract and saw that digital downloads were being paid out at the "sale" rate of (est) $0.25 per track, but the words on the page said any "license" should be paid out at $0.50 per track. He took them to court, for himself, and also for clarity in the rules of business. He won. A lot of money. Other artists started to notice this... There's an alternate reality where more forward people would've been thinking about consumers as audiences instead of wallets, but that didn't happen, and here we are, arguing over the table scraps that Sony/Warner/Universal leave for the independents.
z3t4 11y ago
The difference between a "bot" and a real person is that the real person have money to spend. Now, how do you figure out if someone is a real person or not?
- justindocanto 11y ago
  What if the bot had an allowance and periodically bought music (on iTunes, if they were using Apple Music) OR if the bot had a 'premium' Spotify account. What is the difference then? Also, what is worse? A bot with a premium account or a human with a free account?
  - 6stringmerc 11y ago
    Damn, that's a stone cold divergence based on priorities. I think asking a "label" versus an "artist" might yield different results, depending on priorities. Nice food for thought on that logic tree.
deleted 11y ago
[deleted]
- ZoF 11y ago
  This is referenced in the article.
tracker1 11y ago
In the end I feel we need better captcha options.. images for most people with options for the impared. In the end stuff that's relatively easy for a person (click the picture of a cat), but harder for a computer to do... Another option might be regular challenge-response that makes interaction harder and more costly for a fake listener.. having to run a pbfdk, scrypt or other result on a given input at regular intervals... (the service could have a pre-computed pool to randomly serve out, so they wouldn't have the same costs). They could also flag accounts that get my than N hours of play in a day, or number of days that's much higher than a typical listener... or who plays more artists/songs outside the top 10k songs the previous month. Asking them to login to their account, or validate their email address at that point... Anything that makes the process much more complicatied to automate but would affect a very low number of real people. Yes, it's an arms race, but there are a lot of things that could be done that could keep the barbarians out of the gates... Not to mention other suggestions that split per-user royalties to artists, instead of the pool as a whole... That combined with other models could go a long way here.
pandog 11y ago
There is really no need to call this a botnet
- NullCharacter 11y ago
  But the point is a botnet could, instead of mining bitcoins for example, stream content of which the rights are owned by the botnet operator.
  - ryanlol 11y ago
    Except this would be infinitely more traceable and would still require quite a bit of development work, whereas bitcoin mining is really easy. And using a botnet to do this offers no benefits from just running it on your own hardware. Unlike bitcoin mining, running spotify clients isn't resource intensive.
  - pandog 11y ago
    I suppose, but the thing with doing something like this on a botnet is you need to put that bit of spotify listening software on all those infected computers. Once spotify got their hands on the software they could come up with ways to defeat it.
acd 11y ago
You can filter this out. Using Spam filtering bot detection security methods.
mschuster91 11y ago
As long as Spotify doesn't make a loss on the payout per streamed listen event and the pay-in from advertising, I don't see any problem. Spotify has a pretty much working monetization model, they could just tell advertising to fuck off. Their free model is like classic radio, where advertisers pay without knowing if there is one listener tuned in or millions (literally).
ryanlol 11y ago
I think calling this a botnet, albeit technically correct is both really silly and clickbaity.
- 6stringmerc 11y ago
  So, what would you call it then? If it's technically correct then being needlessly contradictory is silly and superfluous.
  - ryanlol 11y ago
    "Botnet" almost always refers to compromised computers, that's not what this article talks about. The article describes a ridiculously ineffective approach of buying a bunch of EC2 instances to run 50(!) copies of spotify each, when you should be able to easily support thousands of instances of spotify running on a single server. There's no need to do this using a botnet, there's no point in doing this using a botnet... It's utter nonsense. The only reason they talk about one is to make the whole thing sound far more nefarious than it is. And to reiterate my point once more, nobody ever refers to remotely managing their own computers as a "botnet".
    - tragic 11y ago
      OK then, it's proof of concept for a botnet. That would make the headline awfully long.
      - ryanlol 11y ago
        It'd be ridiculously stupid to have a botnet do this instead of running it on your own hardware. Again, you can easily run thousands of spotify clients on a single computer.
        6stringmerc 11y ago
        Fair enough. I think his assertion that using an exploit to compromise Spotify Premium account users (via targeted malware) is kind of the extreme example to justify the term botnet. Unless I'm mistaken, running thousands of clients on the same computer would take a lot of effort to 'distribute' over enough IPs as to cloak the operation? I get that you have some beef with the phrasing used, but I think for the sake of practicality calling "a network of robots posing as humans" a botnet is fine and not click bait at its core. Not to belabor the point but I'm pretty sure I could scold you about some improper music terminology usage when you'd be trying to make a point.

120 points by 6stringmerc 11y ago

I wondered about this, I figured someone had figured out they could use pretty standard click fraud techniques to milk money out of the pay-per-play ecosystem. No doubt someone in operations over at Spotify spends their nights trying to detect these kinds of patterns. It would be interesting to hear their take on it.

6stringmerc 11y ago
Agreed! Considering how much discussion there has been regarding transparency in the music business - the leak of confidential information via the Sony hack being one of the few instances where numbers are exposed - I think this could be a viable avenue for Spotify to make their case better to artists. Also, I'd hope it's one of the few areas where Spotify and other services can legitimately have "free reign" to discuss their operations without being handcuffed by non-disclosure clauses in contracts.

hiou 11y ago

I feel like the writer of this article has a fundamental misunderstanding of Spotify's business model. The number of plays influences how much money Spotify brings in from advertisements. As far as they are concerned fake and real plays are not much different beyond maintaining credibility with their advertisers.

forrestthewoods 11y ago
"beyond maintaining credibility with their advertisers" This may come as a surprise to you, but advertisers are deeply concerned with click-fraud and impression reliability/value. So it's not important to Spotify... except for this one reason that actually makes it super important.
- hiou 11y ago
  Right, that is exactly what I said. I feel like you misunderstood my comment.
  - ZoF 11y ago
    I feel like you're misunderstanding the situation to be honest... >As far as they are concerned fake and real plays are not much different This is flagrantly false given that they do care whether plays are legitimate because they do want to be able to verify with advertisers that plays are served to credible clients... Are you implying that Spotify would expect that advertisers are stupid/inept enough to not notice when a large number of ads are served to fake/bot consumers? Spotify as a company has the prerogative of acting with integrity in these situations if only for future maintainability/acquisition of relationships with advertisers. Even if an advertiser was inept enough to not notice their ads were served largely to bots the value of those ads would still ultimately be lowered by them being served to bots. e.g. if 1000 ads are served and 500 are sent to bots, the overall value of each clicked ad is eventually lowered by 50%. This is assuming an advertiser is so inept they aren't measuring clicks per served ad, which doesn't even occur. I think you're fundamentally misunderstanding why spotify _does_ have to maintain the credibility of those ad clicks/listens/etc...
    - hiou 11y ago
      > As far as they are concerned fake and real plays are not much different beyond maintaining credibility with their advertisers. No real desire to argue the semantics of what I wrote. This is bizarre. Anyhow, the difference is that one situation is an issue of perception and the other is of actual fraud. Not sure why you think perception and reality are identical things.
      - ZoF 11y ago
        What? Botnets 'listening' or 'streaming' is fraud. That it's not immediately identified is obviously not an issue. E.g spotify isn't affected by the fact that the steps outlined in this post occurred. They are however affected by the fact that this is possible on a larger scale. The post has demonstrated that the cost of server time for generating 'listens' is less than the amount of royalties paid out. Therefore any artist with the appropriate technical ability could code up a botnet that generates him more revenue then he is spending whilst having literally 0 legitimate fans/listeners. Are you seriously not able to understand why this is an issue? Yes; In isolation, this singular post isn't a problem. But when freemoneyforbadmusic.ru pops up offering 10000000 listens for 5$ spotify will have a real problem. What are you not understanding about this? There's nothing really semantically wrong with what you've said. It's just factually incorrect.
acgourley 11y ago
Spotify very much cares - Advertisers ultimately will measure clicks and if listens increase without clicks increasing, the payout from ads will drop.

deleted 11y ago

[deleted]

SeanAnderson 11y ago

(I misread. It's 8/100th of a cent. Much more realistic.) Artists on Spotify earn 8 cents each time their song is played? That figure seems really, really high to me. I'm not especially surprised this is possible, but it comes as a huge shock that it would be financially profitable for someone. A quick glance at some other articles (http://www.theguardian.com/technology/2015/apr/03/how-much-musicians-make-spotify-itunes-youtube http://www.theguardian.com/technology/2015/apr/03/how-much-m...) shows drastically different figures: "For example, Spotify says that its average payout for a stream to labels and publishers is between $0.006 and $0.0084 but Information Is Beautiful suggests that the average payment to an artist from the label portion of that is $0.001128 – this being what a signed artist receives after the label's share." This would make it much more expensive to run a botnet through AWS than any potential profits it could generate. Some other thoughts after reading more closely: - It's surprising that the minimum listen time required for payout is 30 seconds when average song length is 3 minutes (or even higher? A reported 3m 45s: http://www.statcrunch.com/5.0/viewreport.php?reportid=28647&groupid=948 http://www.statcrunch.com/5.0/viewreport.php?reportid=28647&...). Is listening to 3/18th of a song really enough to warrant payout? Maybe. - The opening sentence isn't all that truthful. It's implying that an average user is just going to open Spotify, mute it, and go to sleep. That means they won't be there to skip every 30 seconds. So, we fall back to the 3 minute average. Assuming you sleep for 8 hours that means you're only going to get 160 plays or ~12 cents not 72.

michael_fine 11y ago
artists’ take for ad-supported listeners was **0.08** cents per song Actually, it's 8 hundredths of a cent per song, which is more in line with other sources on that.
azeirah 11y ago
You misread it, it says "was 0.08 cents per song", that's 8/100th of a cent, not 8/100th of a dollar
- SeanAnderson 11y ago
  Ahhh, okay. My mistake. That makes more sense.

mootothemax 11y ago

Isn't there potential here for a much more nefarious plan than merely earning revenue from fake listens? If you could do the same thing across a few services, spreading the number listens out on a viral pattern, based on a bit of investment in highly marketable songs, it sounds like you could create a bedroom-singer rags-to-riches superstar story and potentially make millions upon millions.

6stringmerc 11y ago
Yes, I think you're on point with how the exploit could work. Just as reference, I do think the notion of "payola" is similar in practice - using avenues to represent an organic growth of interest, but achieved through alternate means.
paulasmuth 11y ago
A similar thing has happened in the past: >> "Gracia was selected to represented [sic] Germany in the Eurovision Song Contest with the song "Run & Hide", produced and composed by David Brandes. After the German national pre-selection for the Eurovision Song Contest it was revealed that Brandes had bought thousands of his own CDs to ensure chart placement, a requirement of the ESC" https://en.wikipedia.org/wiki/Gracia_Baur https://en.wikipedia.org/wiki/Gracia_Baur
- mahouse 11y ago
  Instead of that pedantic "sic" you could have, you know, fixed the article.
  - thedufer 11y ago
    Can you really call it a direct wrote at that point? [sic] is an accepted way to avoid integrity issues when quoting.
- nommm-nommm 11y ago
  Oh this is a common way to get on the NY Times Bestsellers List. https://en.wikipedia.org/wiki/The_New_York_Times_Best_Seller_list https://en.wikipedia.org/wiki/The_New_York_Times_Best_Seller...

dontreact 11y ago

This seems to be another argument in favor of the model proposed here: https://news.ycombinator.com/item?id=9226497 https://news.ycombinator.com/item?id=9226497 Split revenue per individual amongst artists, instead of splitting total revenue amongst artists.

13thLetter 11y ago

The takeaway I'm getting from this is, as with other websites, the attempt to fund streaming music indirectly via targeted advertising is hopelessly unable to keep up with ever-more-clever click fraud. At best, we end up with an arms race of more and more powerful "criminal" botnets and more and more heavyweight advertising tech crowding out the original content. I'm becoming very sympathetic to the viewpoint of backing out towards either completely untargeted advertising (which, paradoxically, can be far more effective) or -- and, admittedly, I'm going crazy out on a limb here -- paying for content.

ianlevesque 11y ago
Paying for content worked great until the middle class collapsed.
- krschultz 11y ago
  s/middle class collapsed/broadband became prevalent/
  - 6stringmerc 11y ago
    "What do you mean people can use their computers to listen to music and copy things infinitely? There's no money in that! We should try and kill this Napster thing to protect selling CDs for $20 a pop and never support online distribution no matter the customer demand!" - The Music Industry (paraphrased for sarcastic effect)
    - cwyers 11y ago
      And... were they wrong?
      - 6stringmerc 11y ago
        That depends! Are you on the side of Cliff Burton era Metallica as a band that encouraged tape trading as an avenue for exposure, or are you on the side of Lars Ulrich era Metallica that feels people sharing music without paying money are enemies of the band? If you believe in the latter, then that's a perfectly reasonable position for record labels and publishers who invest in "startup" acts hoping they get enough ROI to cover the failures, and then give the successful bands only what they're contractually owed after recouping. Sure, that's a business model. The only number that matters is the number of people paying for the recording. If you're in the camp of the former, you might think that organic growth and demand for your supply means getting to hit as many ears as possible is a chance to broaden the base of people willing to pay for more. Just because somebody can get a recording for free doesn't mean they aren't interested in giving you money for a live show or a t-shirt or a sticker. The bigger the fan base, the better the income potential. I'm going to assume you didn't live through the same era that I did, when Napster was more prevalent in dorm rooms than illegal booze. After that window got slammed shut, the industry narrative (backed by an ignorant Judge's opinion that "the computer is not an audio device") was that anybody who didn't buy retail was a criminal. Ever buy a used CD? That was another target. There was a huge opportunity to embrace technological evolution. Not until Steve Jobs and iTunes worked out the mechanics of DRM and "buying a license" did the industry decide to get on board. It seemed like the industry had their cake and could eat it too...until Eminem looked at his contract and saw that digital downloads were being paid out at the "sale" rate of (est) $0.25 per track, but the words on the page said any "license" should be paid out at $0.50 per track. He took them to court, for himself, and also for clarity in the rules of business. He won. A lot of money. Other artists started to notice this... There's an alternate reality where more forward people would've been thinking about consumers as audiences instead of wallets, but that didn't happen, and here we are, arguing over the table scraps that Sony/Warner/Universal leave for the independents.

z3t4 11y ago

The difference between a "bot" and a real person is that the real person have money to spend. Now, how do you figure out if someone is a real person or not?

justindocanto 11y ago
What if the bot had an allowance and periodically bought music (on iTunes, if they were using Apple Music) OR if the bot had a 'premium' Spotify account. What is the difference then? Also, what is worse? A bot with a premium account or a human with a free account?
- 6stringmerc 11y ago
  Damn, that's a stone cold divergence based on priorities. I think asking a "label" versus an "artist" might yield different results, depending on priorities. Nice food for thought on that logic tree.

deleted 11y ago

[deleted]

ZoF 11y ago
This is referenced in the article.

tracker1 11y ago

In the end I feel we need better captcha options.. images for most people with options for the impared. In the end stuff that's relatively easy for a person (click the picture of a cat), but harder for a computer to do... Another option might be regular challenge-response that makes interaction harder and more costly for a fake listener.. having to run a pbfdk, scrypt or other result on a given input at regular intervals... (the service could have a pre-computed pool to randomly serve out, so they wouldn't have the same costs). They could also flag accounts that get my than N hours of play in a day, or number of days that's much higher than a typical listener... or who plays more artists/songs outside the top 10k songs the previous month. Asking them to login to their account, or validate their email address at that point... Anything that makes the process much more complicatied to automate but would affect a very low number of real people. Yes, it's an arms race, but there are a lot of things that could be done that could keep the barbarians out of the gates... Not to mention other suggestions that split per-user royalties to artists, instead of the pool as a whole... That combined with other models could go a long way here.

pandog 11y ago

There is really no need to call this a botnet

NullCharacter 11y ago
But the point is a botnet could, instead of mining bitcoins for example, stream content of which the rights are owned by the botnet operator.
- ryanlol 11y ago
  Except this would be infinitely more traceable and would still require quite a bit of development work, whereas bitcoin mining is really easy. And using a botnet to do this offers no benefits from just running it on your own hardware. Unlike bitcoin mining, running spotify clients isn't resource intensive.
- pandog 11y ago
  I suppose, but the thing with doing something like this on a botnet is you need to put that bit of spotify listening software on all those infected computers. Once spotify got their hands on the software they could come up with ways to defeat it.

acd 11y ago

You can filter this out. Using Spam filtering bot detection security methods.

mschuster91 11y ago

As long as Spotify doesn't make a loss on the payout per streamed listen event and the pay-in from advertising, I don't see any problem. Spotify has a pretty much working monetization model, they could just tell advertising to fuck off. Their free model is like classic radio, where advertisers pay without knowing if there is one listener tuned in or millions (literally).

ryanlol 11y ago

I think calling this a botnet, albeit technically correct is both really silly and clickbaity.

6stringmerc 11y ago
So, what would you call it then? If it's technically correct then being needlessly contradictory is silly and superfluous.
- ryanlol 11y ago
  "Botnet" almost always refers to compromised computers, that's not what this article talks about. The article describes a ridiculously ineffective approach of buying a bunch of EC2 instances to run 50(!) copies of spotify each, when you should be able to easily support thousands of instances of spotify running on a single server. There's no need to do this using a botnet, there's no point in doing this using a botnet... It's utter nonsense. The only reason they talk about one is to make the whole thing sound far more nefarious than it is. And to reiterate my point once more, nobody ever refers to remotely managing their own computers as a "botnet".
  - tragic 11y ago
    OK then, it's proof of concept for a botnet. That would make the headline awfully long.
    - ryanlol 11y ago
      It'd be ridiculously stupid to have a botnet do this instead of running it on your own hardware. Again, you can easily run thousands of spotify clients on a single computer.
      - 6stringmerc 11y ago
        Fair enough. I think his assertion that using an exploit to compromise Spotify Premium account users (via targeted malware) is kind of the extreme example to justify the term botnet. Unless I'm mistaken, running thousands of clients on the same computer would take a lot of effort to 'distribute' over enough IPs as to cloak the operation? I get that you have some beef with the phrasing used, but I think for the sake of practicality calling "a network of robots posing as humans" a botnet is fine and not click bait at its core. Not to belabor the point but I'm pretty sure I could scold you about some improper music terminology usage when you'd be trying to make a point.