7 ms·

I'm going to give it less than a year now that it has been featured on HN. This is too user facing and too easy to modify for DRM circumvention (if it isn't al

I'm going to give it less than a year now that it has been featured on HN. This is too user facing and too easy to modify for DRM circumvention (if it isn't already doing that) Whether it dies through a DMCA takedown or harder DRM measures remains to be seen. I'm always sad to see people investing lots of time into creating great software that exists in a legal dark grey zone and will inevitably be nuked. And yes I'm also not happy with the standard Spotify client

bob1029 5y ago
DRM for audio is so laughable. Any bit of patience allows for even the most rookie of users to rip a track from spotify. If it weren't for all the legal agreements with copyright holders, I feel like spotify would already have an open playback API.
- 56h4h4h 5y ago
  The name of the game is risk mitigation. In this case, there are lots of ways to rip a singular track. They are usually slow because you record the audio stream from Spotify. But if you could get the original file from Spotify's servers and decrypt it yourself, you could automate downloading your entire library, offline forever at source quality DRM free. Unfortunately, that is illegal and Spotify is going to dick them with lawyers. Pretty sure that's what happened to this project: https://news.ycombinator.com/item?id=25017167 https://news.ycombinator.com/item?id=25017167 History: after the developer decided to pivot from only being a tool to scrape the encryption keys needed to decrypt an individual song, the developer decided it would be a good idea to build in automating the downloading and also decryption of those files, instead of letting people develop that as a separate tool. Developer and project has disappeared shortly after that decision.
  - 1vuio0pswjnm7 5y ago
    Archive.org still has copies.
  - fabianhjr 5y ago
    > source quality Spotify does at most MP3 320kbps, source quality would imply something like lossless FLAC/AAC
    - tim-- 5y ago
      I thought that the audio from Spotify was all ogg?
    - vladvasiliu 5y ago
      They probably mean source as in "what you get from Spotify", as opposed to what you can record after Spotify has decoded it, which you'd have to re-encode.
    - deleted 5y ago
      [deleted]
- dawnerd 5y ago
  Rdio had an api that let you playback songs with a valid user token. It was really sweet.
Qub3d 5y ago
Anecdotally, the only other Spotify UI I've seen on HN is still going strong after 2 years: https://github.com/Rigellute/spotify-tui https://github.com/Rigellute/spotify-tui
- Vespasian 5y ago
  They don't break the DRM and use the official WebAPI. > This app uses the Web API from Spotify, which doesn't handle streaming itself. So you'll need either an official Spotify client open or a lighter weight alternative such as spotifyd.
  - Qub3d 5y ago
    This app does, too. It uses aspotify[0], which is just a rust spotify API wrapper. https://github.com/KaiJewson/aspotify https://github.com/KaiJewson/aspotify
    - Vespasian 5y ago
      It also breaks the drm. Search for "decrypt" in the repo for psst.
codetrotter 5y ago
> harder DRM measures Is that even possible for Spotify at this point? The OP project is speaking to Spotify servers through the same means that official clients are, but the official clients are not just on iOS, Android, macOS and Windows. There’s official Spotify clients on almost every platform imaginable. Everything from PS4 to built into TVs. And even a lot of stereo systems have Spotify Connect built into them. Spotify Connect works by having these other devices streaming and playing the media, and your computer or phone acting as a “remote” for choosing the songs to be played. See https://www.spotify.com/us/connect/ https://www.spotify.com/us/connect/ Basically they’d have to break a lot of official clients, many of which probably cannot be updated, if they were to change their DRM scheme. How do you update a receiver for example? Well, you might be able to flash a new firmware with a USB stick. But for regular people, they are not going to do that. And the DRM scheme, at least as of yet, would be defeated by the reverse engineers as DRM always is. And hopefully continues to be. So at least as of yet I think they would hurt people with official clients more than they would hurt anyone using an unofficial client. And even people using unofficial clients are probably paying customers. Besides what’s the point anyways, everyone knows that if you really really want to rip audio you don’t need to circumvent any DRM at all. You can play the song on your computer or your phone and take the analog signal that is going to the speakers and digitize it again and make an imperfect but still good copy of any audio. Admittedly it doesn’t scale anywhere near as good as automatically stripping DRM though.
- ramesh31 5y ago
  This is a great point. It's truly no different than a third party manufacturer writing some device firmware to connect with Spotify.
  - vladvasiliu 5y ago
    But as a sibling has posted, this is a posture / plausible deniability thing. I've looked it up a few years ago, so this may have changed, but at the time you couldn't just ask Spotify for the SDK / docs to build your own Connect client. I don't remember the details, but you'd have to jump through some hoops, at which point I stopped looking since I wasn't about to build anything industrial. I expect some terms would be that you'd at least try to protect the keys.
thebean11 5y ago
> This is too user facing and too easy to modify for DRM circumvention (if it isn't already doing that) How?
- Brian_K_White 5y ago
  Google "pianobarfly"
Brian_K_White 5y ago
I've been using pianobar and pithos and pandoroid for my paid Pandora account for over 10 years.
stjohnswarts 5y ago
You realize there are other unofficial spotify clients and have been for years don't you?
bluepizza 5y ago
They do not exist in a legal grey zone. Spotify has open APIs. Using them is allowed.
- nfd 5y ago
  librespot is a reverse-engineered thin client (using the same api that e.g. your "smart speakers" would). It doesn't use official APIs, arguably violates DMCA, and you pretty much have to use it if you don't want to simultaneously run the full thick official client on the same device at the same time.

bob1029 5y ago

DRM for audio is so laughable. Any bit of patience allows for even the most rookie of users to rip a track from spotify. If it weren't for all the legal agreements with copyright holders, I feel like spotify would already have an open playback API.

56h4h4h 5y ago
The name of the game is risk mitigation. In this case, there are lots of ways to rip a singular track. They are usually slow because you record the audio stream from Spotify. But if you could get the original file from Spotify's servers and decrypt it yourself, you could automate downloading your entire library, offline forever at source quality DRM free. Unfortunately, that is illegal and Spotify is going to dick them with lawyers. Pretty sure that's what happened to this project: https://news.ycombinator.com/item?id=25017167 https://news.ycombinator.com/item?id=25017167 History: after the developer decided to pivot from only being a tool to scrape the encryption keys needed to decrypt an individual song, the developer decided it would be a good idea to build in automating the downloading and also decryption of those files, instead of letting people develop that as a separate tool. Developer and project has disappeared shortly after that decision.
- 1vuio0pswjnm7 5y ago
  Archive.org still has copies.
- fabianhjr 5y ago
  > source quality Spotify does at most MP3 320kbps, source quality would imply something like lossless FLAC/AAC
  - tim-- 5y ago
    I thought that the audio from Spotify was all ogg?
  - vladvasiliu 5y ago
    They probably mean source as in "what you get from Spotify", as opposed to what you can record after Spotify has decoded it, which you'd have to re-encode.
  - deleted 5y ago
    [deleted]
dawnerd 5y ago
Rdio had an api that let you playback songs with a valid user token. It was really sweet.

Qub3d 5y ago

Anecdotally, the only other Spotify UI I've seen on HN is still going strong after 2 years: https://github.com/Rigellute/spotify-tui https://github.com/Rigellute/spotify-tui

Vespasian 5y ago
They don't break the DRM and use the official WebAPI. > This app uses the Web API from Spotify, which doesn't handle streaming itself. So you'll need either an official Spotify client open or a lighter weight alternative such as spotifyd.
- Qub3d 5y ago
  This app does, too. It uses aspotify[0], which is just a rust spotify API wrapper. https://github.com/KaiJewson/aspotify https://github.com/KaiJewson/aspotify
  - Vespasian 5y ago
    It also breaks the drm. Search for "decrypt" in the repo for psst.

codetrotter 5y ago

> harder DRM measures Is that even possible for Spotify at this point? The OP project is speaking to Spotify servers through the same means that official clients are, but the official clients are not just on iOS, Android, macOS and Windows. There’s official Spotify clients on almost every platform imaginable. Everything from PS4 to built into TVs. And even a lot of stereo systems have Spotify Connect built into them. Spotify Connect works by having these other devices streaming and playing the media, and your computer or phone acting as a “remote” for choosing the songs to be played. See https://www.spotify.com/us/connect/ https://www.spotify.com/us/connect/ Basically they’d have to break a lot of official clients, many of which probably cannot be updated, if they were to change their DRM scheme. How do you update a receiver for example? Well, you might be able to flash a new firmware with a USB stick. But for regular people, they are not going to do that. And the DRM scheme, at least as of yet, would be defeated by the reverse engineers as DRM always is. And hopefully continues to be. So at least as of yet I think they would hurt people with official clients more than they would hurt anyone using an unofficial client. And even people using unofficial clients are probably paying customers. Besides what’s the point anyways, everyone knows that if you really really want to rip audio you don’t need to circumvent any DRM at all. You can play the song on your computer or your phone and take the analog signal that is going to the speakers and digitize it again and make an imperfect but still good copy of any audio. Admittedly it doesn’t scale anywhere near as good as automatically stripping DRM though.

ramesh31 5y ago
This is a great point. It's truly no different than a third party manufacturer writing some device firmware to connect with Spotify.
- vladvasiliu 5y ago
  But as a sibling has posted, this is a posture / plausible deniability thing. I've looked it up a few years ago, so this may have changed, but at the time you couldn't just ask Spotify for the SDK / docs to build your own Connect client. I don't remember the details, but you'd have to jump through some hoops, at which point I stopped looking since I wasn't about to build anything industrial. I expect some terms would be that you'd at least try to protect the keys.

thebean11 5y ago

> This is too user facing and too easy to modify for DRM circumvention (if it isn't already doing that) How?

Brian_K_White 5y ago
Google "pianobarfly"

Brian_K_White 5y ago

I've been using pianobar and pithos and pandoroid for my paid Pandora account for over 10 years.

stjohnswarts 5y ago

You realize there are other unofficial spotify clients and have been for years don't you?

bluepizza 5y ago

They do not exist in a legal grey zone. Spotify has open APIs. Using them is allowed.

nfd 5y ago
librespot is a reverse-engineered thin client (using the same api that e.g. your "smart speakers" would). It doesn't use official APIs, arguably violates DMCA, and you pretty much have to use it if you don't want to simultaneously run the full thick official client on the same device at the same time.