MySpaceGrab Dissapears, MySpace Songs Still Downloadable.

Over the past few months many people have been using a popular site called MySpaceGrab to download songs from bands profiles. The site simply asked for the band’s MySpace URL and then presented you with a link to download each song. Today, somebody asked me if it’s possible and I told them “yes, these guys have been doing it for a while.” That’s when he noticed that the site simply has a message saying “This Site Has Been Stopped. Please Click Here
And Fill Out Your Details In Order To Support Us.”

I’d have given you a link, but the “click here” is a sleezy link to a debt professional website.

The way the site worked was pretty simple. The MySpace flash music player is simply calling another file on the server. You can’t see the link to the file on the page, nor can you get it from the page source. Instead, you have to monitor the requests your web browser makes. The easiest way is to look at the URL in the bottom status bar as it’s loading (easy in safari) or you can get some fancy firefox extensions.

I’m not 100% sure if MySpace or the RIAA were responsible for shutting down the site. If I were in this position, I’d make sure that a copy of my code somehow got posted on all the free php scripts websites. This way, it would force MySpace to actually fix the way they play music. I think we all agree that the code base of that site should probably be completely re-written.

It’s also an interesting legal issue here as well. Simply obfuscating filenames is NOT a secure way of doing anything. Security by obscurity is not security. It’s the online equivalent to hiding something in the woods and hoping nobody finds it.

While I don’t condone using a site like this, I also don’t condone getting legal protection to step in because you can’t figure out how to solve your own problems in code. It’s very similar to the whole ticketmaster captcha problem.

I also want to point out that I don’t condone illegally downloading music in any way (file sharing, ripping cds for friends, from myspace, etc) As somebody who writes software for a living, I wouldn’t want you to steal my stuff so I don’t steal yours. (in fact, you’ll find the CDs for all 5,000 songs on my ipod collecting dust in my spare bedroom.)

In the case of MySpace simply putting the files online with obfuscated names so that anybody who stumbles onto the name can download it though, it’s hard to blame those who take it. I mean if somebody left a $20 bill on my porch, I’d probably take it.

2 comments December 27th, 2007