SpotifyKeyDumper – Dump song decryption keys from the Windows Spotify client
gitlab.com
gitlab.com
Fast forward to seeing this, and I realize this doesn't have the same draw as it would have 20 years ago. People can get the music they want at a price they're willing to accept.
People rationally evaluate the cost to breaking the law. It's not a perfect economics 201 model, though, as its not like increasing the enforcement and costs fully deter piracy engagement.
All the non-mainstream music makes I follow since I was a teenager complain that music has never been in a harder place in terms of making money off of it. Apparently their piece of the cake has massively reduced.
This should be expected, given that the amount of artists making commercial non-mainstream music has skyrocketed. The pie has gotten bigger, and the non-mainstream share of the pie has gotten bigger, but there's a lot more people fighting over its scraps.
There’s a whole market of tool-assisted beat and melody makers that build and curate then offer these for sell for artists to buy. The whole process is heavily industrialised, tools allow the maker to produce dozens of such bricks a day, basically bruteforcing a whole space, but everything resembles everything else, diluted to no end, channeling the money stream and bleeding the “old way” creators to death.
Albums have been dying for a while already, even EPs are barely living corpses in this attention grabbing landscape. Even for singles there’s just no way to mature ideas and create truly creative content in an amount of time that allows to keep up pace and make money through these platforms. So they stay on the local scene, which is being obliterated by COVID.
I think this idea is misguided. The more music you produce, the more good music you produce. Trying to keep average quality up by restricting production is counterproductive in two separate ways; (1) it ends up causing you to produce lower-quality output than otherwise, and (2) nobody cares that you released some bad songs if you also released some good songs.
I read a fun paper documenting this very effect (the first one) in a college pottery class. One class was told the grading procedure would be as follows:
1. Over the course of the term, you make some pots. It's up to you.
2. Turn in all your pots at the end of the term.
3. The instructor will evaluate your pots for quality, and you will receive a grade accordingly.
A second class was told they'd be graded like so:
1. Over the course of the term, you make some pots. It's up to you.
2. Turn in all your pots at the end of the term.
3. The instructor will never look at your pots. They will be smashed into tiny shards, and your shards will be weighed. Your grade will be based on the weight of your accumulated pots after they are destroyed. More is better.
In fact, the pots in group two were evaluated for quality just like group one. Students in group two produced more pots. They also produced better pots.
Also, it’s not justified to assume artists didn’t practice and produce early iterations e between public releases.
So what? Where did I make that assumption?
I'm assuming some combination of these two factors:
1. If you have three public releases, you probably put in more work overall than if you had only two public releases.
2. There are diminishing returns to polishing a song, such that the same amount of work is more productive spent on two songs than it is spent on a single song.
Or maybe you put in less work into each release?
There are many authors who produce one or two books a year, and those books are complete garbage. Some of the the best authors in history just wrote a few masterpieces.
Even with artists that were capable of a great output, it's not obvious that the quality of their art improves with time, beyond their formative years.
Some of the best authors in history just released a few masterpieces.
They'll likely have written a lot more.
This article sheds some light on the issue https://www.rollingstone.com/music/music-features/should-spo...
Maybe the problem is not that it is hard for non-mainstream music to find its supporters. Maybe the problem is that non-mainstream musicians are deluded to think they have enough supporters to make a living off their music.
Even YouTubers that produce free content can make a living off Patreon. Even some podcasters can.
They just need to change the model. A Youtuber doesn't have 80% of their earnings go to a record label.
The issue is that attention is a scarce resource, and the means to keep it through market formulas and analysis of trends have become way too effective. Artists are now in a race to the bottom where they have to choose between playing the game, and changing their style, message and work to chase engagement metrics, or resign themselves to be drowned and forgotten for staying "real"
Youtubers suffer the same fate. You can see people moving from tech reviews to game streaming and then to music production or vlogging in their search for views. But they (most of them) are more businessmen than artists, and don't feel tied to a message or artistic vision that they need to communicate.
I'd argue that an ideal system should have a place for artistic quality to shine beyond entertainment, and that used to happen, at least to a higher degree than it does now. Which is not to say that everything's worse: the tools to become a creator are better and more accessible than ever (hardware, resources to learn, etc).
I’d love to be able to pay a cloud service to be able to stop shuttling rare files around.
And I guess it’s against their ToS.
People can get what is popular. There's just so many albums and soundtracks that just can't be found on Spotify. Legal streaming is nothing compared to the private music torrent tracker scene... Before it was shut down, one particular site was often called the library of Alexandria for music and even had actual artists release their music there.
What CD was a private music tracker. It's hard to describe the range of music that was there. And there was a huge community that really knew its music so you could discover some really cool music through collections and the forum.
Redacted is the tracker that rose up as it's replacement after What CD was shut down.
I don't get peoples obsession with only using acronyms when you can just Google "<acronym> tracker" and get the name.
Googling "RED interview" should provide you with an alternate pathway in, however.
People can rent the music, they cannot really get it. (Of course, piracy is not a way to own music legally either...)
Here's a song I added to my library a few years ago that I can no longer listen to. It's too bad I didn't buy this song instead of rent it. I could still listen to it if I had... https://open.spotify.com/track/5gk4KOkSqWOCUjnxzILSTG?si=Orl...
The licensing agreements that spotify negotiates are between them and the artists, and if artists are unhappy they can take it up with Spotify. But hopefully artists realize that for recorded performances, there is a sweet spot where the convenience of a subscription has a higher value than trivially accessing pirated recordings.
But to your point. Pre-Spotify I think the overall music market sales volumes and profits, offset by piracy and copyright infringement, ended up around the same overall total market value that Spotify based their subscription and payments off of (that and economics of scale).
I’ve been a Spotify subscriber for a long time so I get it. I just wish Spotify would do more to support artists, not labels, or help fix the system for indies to self-distribute.
It’s obviously way more complicated. I dream of a utopia where a platform exists not for profits sake but for the art’s sake.
We're long past the 1990s, where only a very select number of major label artists made it big and sold millions of copies. We need to stop using these numbers as a benchmark for todays music landscape -- so much has changed and most of it for the better.
Music creation and distribution has been heavily democratized. Where you needed connections and thousands of dollars to even get something released (outside of niche DIY tape style releases) you can now basically do it for free from your room or band practice space. The amount of money per working musician has gone down significantly but there are more of them in 2020 than has ever before.
We can certainly argue about what kind of value art should have in society. Should there be more money going around? What industries should this money be taken out of? Suffice to say independent artists are better off than they have been, creating music and making money has never been easier and Spotify/digital music distribution in general have been great enablers.
Which is a point: Quantity != Quality. This argument makes it seem like anyone can go and earn a living from music and that simply isn’t true. Anyone can make money with music with a little investment in a copyright and BMI id... To make it a career, to live off of, as your sole income source has a lot of musicians having to diversify how, where, they release music.
Artists with indie labels are fighting for air time with other artists with indie labels for $3/1000 plays.
I’m not blaming Spotify outside of the fact that my $9.99/mo subscription (minus 10%) should be allocated based on play time to the artists I listen to. This doesn’t seem to be the case.
Granted, it’s been over 15 years since I released music. I never “made it” in the traditional pre-diy era. Punk Rock is dead based on listenership. I went into tech.
I'm not sure if this is still the case.
There's composers and producers with quite high production values, very complex and intricate music, the kind you want to pay attention to, in order to get the most out of it.
But I don't listen to that music all day. I got other music for background.
In my view the latter is not more valuable because I listen to it for more minutes.
When it was CDs I'd pay roughly the same for my Autechre as my Kruder & Dorfmeister.
Until it doesn't
I use Spotify a lot. Maybe too much. And disappearing music is a real plague. Now it's there, now it's not. Why? Licensing perhaps, who knows.
A good example is that I cancelled Amazon prime this year because with add-on items and ineligible items it stopped providing any value over just meeting the minimum order $ for free shipping.
This is about labels and sometimes artist not wanting to have their songs on spotify anymore.
This is about Tidal or whathername wanting more money from a dying market.
I used to tell myself I couldn't afford all the music I listen to but looking at all the money I have given spotify over the last decade im thinking maybe I could have bought a good chuck of my favourite music by now. so that is what I'm going to do at some point, and maybe just keep spotify for discovering new music every now and again
But it's for the 13 y/o me that was figuring out how to use alcohol 120% to burn the latest games or fix my computer from all the viruses I got downloading movies and music at that time from p2p.
And if it wasn't for that pursuit that led to many other skills and opportunities, I know a lot of us wouldn't be in the financial situations we are in right now.
Did you ever try to boot it from a floppy, just to see what would happen?
So once again, greedy business practices makes it more inconvenient for paying users than for pirates.
When my subscription ends, my library disappears. Not a very attractive deal.
Deezer is doing weird stuff in comparison. A friend told me that each song has every third block of 2048 bytes encrypted using blowfish. The key is derived from the hex md5 of the song ID, xor the same hex md5 but with a Ceasar cipher shift of 16, xor a hard-coded secret. The initialization vector is 0,1,2,3,4,5,6,7.
Wrote a blog post about it back in the day, for those wondering how to break (super easy) encryption: https://lgms.nl/blog-1-plain
Could you, please, explain how?
Now imagine there's a programmer who wants to make the ultimate cube scrambler despite not knowing any of the above. Their brilliant idea is to take the aforementioned algorithms and chain them together. (Result: snafu.)
In essence, the moral of the story is that one shouldn't try stacking encryption algorithms without first acquiring a pretty good understanding of how they all work.
[0] https://www.popsci.com/science/article/2010-08/gods-number-r...
Is the ceiling for “max encryption” that low, or is just that one algorithm combined with another has a local maximum?
> running a few more algorithms on something before trying to decrypt will make it easier rather than harder to decrypt?
No, it could make it easier, harder, or about the same. The ‘harder’ case is just unlikely when the algorithms one started with were already state-of-the-art and the programmer didn't know what they were doing. It might seem tempting to think that a cryptanalyst now has to do twice the work, but what they're really doing isn't cracking multiple encryptions — they're just attacking a different encryption.
If we move the goalposts to where the combined algorithm receives a much larger key than any of the individual parts we're comparing to in terms of crackability, then the likely failure mode isn't ‘weaker’ any more, but ‘stronger, though maybe not as much stronger as was intended’.
The history of triple DES provides a nice practical example: ‘double DES’ isn't a thing because encrypting already-DES-encrypted data with DES again, with a completely separate key (thus effectively doubling the size of the key), does almost nothing to improve security.
A typical example is the crapto-1 Mifare Classic algorithm used to encrypt NFC cards. The way they read from the shift register and combine the bits was dumb and it's complexity weakened the algorithm.
Another I've seen is using two sequential keys XORd against one another to produce and "encryption" key. Turns out reading from low entropic systems very quickly yields a similar enough key that when XORd, partially removes the first one.
The claims of "weakened by combining" are often aired, but all examples I've found so far are basically summarized as "remaining within a group structure" (as in your rubik's cube example whose god number is 20) - which might not be stronger than each individual, but is unlikely to be weaker either -- and algorithm combinations usually DON'T remain within a group structure (e.g. DES is not a group, so 3DES is strictly stronger than DES, even if it might not be 3-times strong in bits)
Without key re-use, there is no way adding another algorithm can weaken an existing encryption.
It's of course not that trivial with better encryption algorithms. But before stacking encryption algorithms, try to first answer what you are trying to achieve (that application of a single algorithm does not).
Spotify is pay-to-play and the royalties model is designed around that. Artists/Labels get a a very small slice of money from every play. As a Spotify consumer you do not pay for the right to play the track offline - if you did, the Artist/Label would get a bigger slice. If you want to play the tracks offline, just buy the non-DRM MP3 from Amazon or some other place.
For people saying the Labels take all the money anyway, there are many independent artists on Spotify who deserve your money if you play their work.
Most of us here are hard working professionals in our fields - how would we feel if someone said at the end of each week, "Thanks for what you did, it's really useful, but I've decided to not pay you, but I'm going to keep your output anyway and use it forever." We wouldn't stand for it, and nor should music artists have to.
Spotify is a choice on your behalf. You can pay their monthly fee and get access to their entire library for as long as you pay them
Or you can buy the mp3s own them forever from apple/amazon/etc. The artists never continue to ask me to pay them.
Personally, I find it better to buy the mp3s. I'll use spotify or pandora and put up with the ads when I want to discover or whatever
Yes you do, this is a specifically advertised feature of Spotify Premium.
> Most of us here are hard working professionals in our fields - how would we feel if someone said at the end of each week, "Thanks for what you did, it's really useful, but I've decided to not pay you, but I'm going to keep your output anyway and use it forever." We wouldn't stand for it, and nor should music artists have to.
When was the last time you paid for software? Were you happy about what you got?
Pay-per-use or pay-per-user simply aren't ethical business models for creative works where all significant costs are up front and fixed.
I was very happy about both and recommend both.
I don't think I get your point. There's lots of quality paid software.
That builds on tons of FLOSS, which I doubt you paid for, so I guess it's not "high quality"?
I just answered plain and simple the question the parent stated, that I bought paid software and that I'm very happy with my purchase.
So for MOST software we use daily we indeed do not pay, bringing up 2, even 10 examples doesn't help with the fact that these are still exceptions.
Now I also happen to be a big supporter of indie artists and my Bandcamp library is in the high thousands of dollars in purchases.
> Thanks for what you did, it's really useful, but I've decided to not pay you, but I'm going to keep your output anyway and use it forever.
Is indeed exactly the stance many, many commercial companies take when utilizing FLOSS in their products.
The Spotify model also mostly benefits your Taylor Swifts, not the indie artists who actually could use it. They don't care about the small guy just as much as many don't care to at least not violate the terms or spirit of the software they use.
It is also worth noting that many of the major artists that benefit the most from Spotify are copyright maximalists, which basically means
"I not only want to profit off the work I did in my 20s and not allow others to reuse it to build new things, I also want my children to be able to do so 70 years after I die, thank you very much."
P.S. Am a free software maintainer myself, but we're talking about monetary contributions here.
Doesn't JetBrains software include a "permanent use" license?
From rough memory, it's not the latest and greatest version... maybe a release or two older than whatever "the latest" release is?
Our society - civilization even - has fallen victim to the belief that there are certain kinds of control over human behavior that are possible and desirable, kinds of control that have never succeeded in human history, and attempting to lock music in a tiny little box to which very few people have the key, is one of those things that has never worked. To expect that to work now is.. so blindingly short sighted that I personally find it fantastically hilarious when it fails.
I don't necessarily think this applies to all professions or all aspects of human behavior but music itself is older than any human civilization and attempting to lock that away is going to be a fight with human nature itself.
And yes, I realize that some people believe that attempting to change that is a good thing. I'm not one of them.
As an indie artist I'd much prefer they let people just download my music as well, enjoy it and support me in other actually meaningful ways.
The recorded music is just a tiny bit of the service that an artist provides. This whole discussion is just diseased from the pop industry that runs on abusing copyright and drills our heads full of constantly repeated songs.
The idea that this is a healthy artistic environment and has anything to do with actual musicians is ridiculous.
If that's the case, you can set up your own website and distribute your music via torrents, youtube (insert youtube-dl joke hereb), or soundcloud.
Sadly they'll never get the amount of attention, funding etc. as Spotify just due to the fact that they won't earn millions on the backs of artists. Exploitation will always win in this kind of market.
I'm still subscribed to Spotify, and mostly listen my music there.
I'd laugh at him because my work cannot be downloaded and copied freely.
How would you know what you liked if you never heard it?
Would you pay for music you have never heard before?
At some point artists need to distribute their work, and to try and push their music to people that have never heard it before, so there is always a balance of advertising vs. revenue.
I imagine most people my age recorded songs off the radio onto cassettes. I still don't feel bad about it, because I bought the albums I cared about.
I agree that what we are discussing is piracy, but I don't believe music piracy to be a zero sum game.
Today there are 30sec excerpts on band camp and Spotify for every song, and there is Youtube.
You could add a print statement in there to dump keys.
EDIT: didn't notice it was gitlab rather than github. I'm still rather interested.
* by this I mean gitlab's own instance of gitlab. Of course, you can host your own, and then its up to you how you respond.
Think twice. Don't let clever legal tricks like were pulled with DMCA catch you out.
DMCA take downs don't delete stuff stored client side on your computer, I fail to see what all this discussion is even about
If it looks hot, just clone it and forget about it
works perfectly fine for me
Github Desktop project mangers are taking notes, don't give them ideas!
Someone correct me if I’m wrong. This is a layman’s understanding.
https://www.law.cornell.edu/uscode/text/17/1201
Which you could argue this falls into.
After all, fuck-capitalism added this prominent disclaimer:
> This program was created for educational purposes. It is not intended to be used otherwise
/sarcasm
Pro-tip: Intent matters to the courts. Intent is really hard to show, since the prosecution has to prove the internal state of your mind when you did the thing.
Focus on plausible deniability when you do this sort of thing. I, for one, still own a Cowon iAudio, and can’t wait to format shift my legitimate subscription to it so I can use my high-end wired headphones.
[1]: https://gitlab.com/fuck-capitalism/spotifykeydumper/-/releas...
A few days ago, I could not access the player and desperately wanted to listen to music, so I looked around in the Firefox dev-tools and unregistered the ServiceWorker. After that, everything worked just fine and I decided to deactivate ServiceWorkers for the Profile which I use for Spotify via about:config.
Every since, I had no trouble anymore. I know writing ServiceWorkers isn't easy, but that is not my point. My point is, that I pay Spotify to deliver music to me in the DRM protected way the music industry demands for (not the consumer). So fixing things gets harder for me with DRM in place.
@Spotify: Please fix your broken software development process and deliver on your promises.
Whatever your views on Spotifys model, breaking that model is stealing.
On a wider issue, Spotify and its ilk should be paying more to artists, with royalties scaled.
There _are_ FOSS alternatives to Visual Studio and Windows which can be used without engaging with capitalists.
Even simply using non-FOSS is an endorsement of it and helps to perpetuate its dominance; there's a reason why Microsoft competes with free by being free, itself.
Fuck-capitalism but obey my rules plebs.