Change librespot to support free accounts

[sashahilton00]

Spotify have changed their policy on Connect being restricted to premium accounts only as detailed in a number of publications:

https://developer.spotify.com/community/news/2018/09/14/updates-mobile-platform/

@plietar would you mind detailing the 1 line change you mentioned earlier that removes the requirement for a premium account?

EDIT: Updated link to point to Spotify dev blog.

[ashthespy]

Probably more relevant:
https://developer.spotify.com/community/news/2018/09/14/updates-mobile-platform/

[kingosticks]

There are still numerous differences between free and premium:

• Audio quality
• Adverts
• 'unlimited skips'

This change undermines Spotify Premium and makes librespot a target, I don't see the point.

[sashahilton00]

@kingosticks good points. Will email one of the devs and ask about that. I do see the point though - if every other Spotify Connect implementation works with free and this one doesn't, it's going to be confusing to people.

[awiouy]

Make it an option?

[plietar]

I agree with @kingosticks. Unless someone goes through the effort of reverse engineering and implementing the Spotify free features (mostly adverts), I don't think it's acceptable to do this.

Even if we do it, it becomes trivial for someone to modify librespot to remove the ads, producing a version which is not compliant with the restrictions imposed by the free service, putting us at risk.

[sashahilton00]

I've sent an email to one of the Spotify devs. We'll see what they say w/ regards to free accounts. My feeling is that making it an option is a possibility, and that rust is sufficiently complex that the number of people who are going to be able to remove and recompile later versions to circumvent the features will be small, and that they're likely already using modified APKs or similar. At the end of the day, if it truly is a one line change, then it's trivial to make librespot work for free accounts in it's current implementation anyway with sufficient knowledge. It may be that the tradeoff of having a small number of people trying to cheat the system is more acceptable to Spotify than having some speakers compatible, some not.

With regards to skips, I'm not sure if it's librespot or the mobile client that tracks the number of skips left. If it's the client, then skips aren't a problem for librespot to deal with, which leaves reverse engineering audio ads. The bitrate cap should be easy enough to implement, just run a check after login, if account type is free and -b 320 is present, panic.

[szymonmatuszczak]

Why would you bother with a Spotify's devs statement? If they want to provide a adverted API, they should do it. This is a open source project and shouldn't implement "security by obscurity" manners. If they want to cap the bitrate, they should do it server side, if they want to force ads, they should implement such thing server side, like sending URL of advert and sending 403 when trying to obtain any other audio data during the ad. I own my computer and I should decide what software running on it does, and they own their servers and they should decide what their computers does. As simple as that. I would probably fork this project as really libre alternative.

[sashahilton00]

Why would you bother with a Spotify's devs statement? If they want to provide a adverted API, they should do it.

Because they may not have the resources to maintain a public library, and because if we circumvent their TOS, then they'll block the project as they have done previously.

This is a open source project and shouldn't implement "security by obscurity" manners.

It doesn't...

If they want to cap the bitrate, they should do it server side, if they want to force ads, they should implement such thing server side, like sending URL of advert and sending 403 when trying to obtain any other audio data during the ad.

If you actually look at the code and how the protocol works, then you'd know that isn't feasible.

I own my computer and I should decide what software running on it does, and they own their servers and they should decide what their computers does.

That's already the case. Don't like it? Don't run it. You're welcome to reverse engineer the protocol further, bypass the free restrictions and then deal with Spotify trying to shut your project down. That's not what this project is about. $10/month for unlimited music is not expensive. For the number of hours you spent trying to reverse engineer their protocol and work around their restrictions, you could probably get a job and just pay for premium for several years get a job that pays for premium for several years.

As simple as that. I would probably fork this project as really libre alternative.

Go ahead, just change the identifiers from librespot so that any changes that are made that may result in your variant being blocked do not affect this project.

Point is, until we hear from them or come up with a way to implement the free restrictions, librespot is premium only.

[pedrogonsilva]

Hi

Any news regarding this?

[sashahilton00]

Nope.

[JustMyGithub]

@sashahilton00 It's been half a year since you wrote that email - Spotify should have replied, didn't they? If not, would you mind reminding them?

[sashahilton00]

I've heard nothing back from Spotify on this. We're not going to be reverse engineering limited skips and ads anytime soon. If someone else wants to do that and PR, we can look into supporting free accounts, but until then, I'm closing this issue.

[probonopd]

limited skips and ads

Are the requirements known?

[mirh]

I mean, if you don't want to be booted out for foul play/piracy, I guess like they are.
Though arguably desktop clients would be already fine with just ads.

[probonopd]

There is a (closed source?) SDK from Spotify for device manufacturers that probably implements all of this.
Would it be an option to dlopen() that binary library and use it for the ads and stuff, if a user is using a Free account? This way nothing would have to be reverse engineered, it would just use the official SDK from Spotify.

[devgianlu]

@probonopd I believe you have to make a request to use that SDK and they'll make a contract with you. I don't think they'll be okay with sharing it with the open source community, given that I would love to get my hands on it to reverse engineer it.

[probonopd]

Well. I am not working for Spotify but I would assume that they share the binary library of the SDK under an NDA that prevents you from reverse-engineering it. But why would anyone want to. For paid accounts, librespot works as-is, and for Free accounts, it could call into that binary blob. At least in theory. (I do not know what strings are attached with getting a license for the binary blob.)