Yoan Blanc’s weblog

Most of the MP3 player I’ve seen doesn’t protect the owner of the MP3 to be stolen. It’s sometimes a choice, but everyone (should) know that by using one of those simple MP3 players in Flash:

• XSPF Player,
• JW Player,
• Dew Player,
• Flam Player,
• Multi,
• Audio Player for Wordpress.

You are offering your MP3 files the same way that if you putted a link on it, called “download it”.

A little bit keen user will find the file and download it, it’s very very easy with the Net tab of Firebug (for Firefox) or the Activity Window of Safari.

Using Firebug on Samples.fr homepage (a very cool blog about who sucks the song of who, only 30 sec. preview).

For a personnal website, a blog or whatever, it’s not a problem from my point of view, because it belongs to you and you are responsible of you do with it. The problem comes with public services.

MySpace has had troubles with their MP3 player back in september 2006 and are now using a more secure player and file delivery system (token based).

At the beginning Mx3 had the same issue, they fixed that a first time by using a token based authentication. But it wasn’t enough, because you could grab the source code of the SWF movie by decompiling it with Flare for example.

v1.GETTOKENURL = '/single/get_token?s=';
v1.GETMP3URL = '/single/get_MP3?h=';
v1.SHAREDKEY = \
  '812664f85904d7458291529ae9c503b3';
[...]
var v2 = com.meychi.ascrypt.MD5.calculate( \
  PlayerCtrl.SHAREDKEY + \
  '--' + \
  this.__getTokenLoadVars.t);
this.__playback.setMedia( \
  PlayerCtrl.GETMP3URL + \
  v2 + ’'&t=' + \
  this.__getTokenLoadVars.t,\
  'MP3');

This issue was solved using a encrypting solution (and changing the shared key of course).

I’ve spent some times to investigate on famous, eye-candy, übercool web radio, music selling, or sound web site. Most of them have no protections at all! Nothing. I built scripts that download all the songs from a query on a band for two of them :

Theses scripts deal only with RSS and Flash Remoting and aren’t more than 100 lines (with comments and bla-bla). But it was easy, no cookies, no sessions, no internal counter, no HTTP header to simulate, ... I have the feeling that I didn’t hack anything, just used the offered RSS based REST or Flash Remoting API. I even didn’t decompile a single SWF file.

To protect your files, don’t rely on technologies like Flash, XML or Flash Remoting but put some kind of authenticaton in the discussion protocol your are using, that cannot be simulated easily outside the MP3 player your are providing. If the URL that gives the file to the player can be runned only one time and cannot be generated without decompiling the swf file, you’ve got it. Next step is to encrypt your swf file and it’s not mandatory for Flash 8 at least. I’ve tested with swf files generated by Flex and cannot find anything, it’s a matter of time I think.

I’m managing to build a MP3 player (based on Flex) and a server that could protect the MP3 it plays from being stolen. More to come.

One kind of protection is to deliver crap: poor quality, not the entire song (like Amazon does), no ID3 tags, random file name, etc.

But music tastes better if you buy it or respect its licence:

• Jamendo
• Free Albums Galore
• CC Mixter

It’s a fact that Switzerland is the country of the watches and the chocolate but also of the trains (because of the watches I guess). So the trains are expensive but almost on time. One thing that surprise me is that I’m still using the swiss web site to find a train between to cities in France, even sometimes the German one that knows about everything.

It’s not about nostaligia it’s because this one rocks by its simplicity. Clean and nothing else. I did a little sample to find how to go from Paris to London (nothing to see with Switzerland of Germany, but enjoy).

To start, the French one, la SNCF. I type sncf.fr which fails, corrected it to www.sncf.fr. Hell, what do I have to do now? After a couple of tries and my great experience I found that it’s Voyage SNCF where I have to click.

To get a results, I had to specify both starts and destination with a stupid popup and to wait on an advertisment. The web pages are full of advertisments and blinky pictures. A very bad experience, but I can buy a ticket at the end.

Now, let’s test from the british web site: National Rails Enquiries. The homepage is clean (see the screenshot) with some autocompletion, brilliant. But it doesn’t know where Paris is and fails miserably.

The german one is interesting because I could hear from french people that live in Germany that they are using it to buy tickets instead of the french one that could simply not for Germany (but the opposite is true). This is the first one that just does the job, it requires to fill its age in the process, that is weird just to know when there is a train to London.

Next one, is the Italy one. I’m not very keen in italian but it’s an interesting one because it’s the only one that has a liquid layout (100%). And in term of efficiency, great. I just entered the two cities and it gives me what I wanted.

And the last one, my favourite: SBB CFF FFS because I’m using it for a while and know how to find things quickly. During the process it asked me to specify the destination station, but already filled it with the most probable choice (the SNCF doesn’t do this sadly).

But seeing all these big interfaces with at least 4 inputs: start, destination, day and hour. Why not doing a simpler alternative: one field. I want to be able to ask: Paris London next Monday and to obtain what I’m asking. Google Switzerland does that for the cities only and it works quite well.

They are lots of bad example of fields that are to complicated. Compare LinkedId (or Xing) and Ziki (its little french cousin). The first one say: “keyword, name, company or title” (whatever in a word) and the second has two fields: “First Name” and “Last Name”, why?. As I’m sure that most of the people still use the mouse to switch from one input field to the next one, they should be more upsetted by this kind of user interface.

As a last reflection, it’s maybe not a good idea to mix concepts like where and when. Most of local services doesn’t mix what and where, but is that only a technical issue? I often don’t like them because they ask you to separate the idea you have. The natural language is very hard to process, but the solution I will use in the future is there.

I’d love to do a comparative between the ticket automat in the train station for different countries because the french one is so lame when you try the italian, german or swiss ones.