Usecases for download/browser button

[erhan-]

Hello,

I wanted to ask what the usecase for the DLoad button is. Why would anyone want to download the music from the stick.
Lets say your favorite big artist is playing at the venue you work in as light technician. This would allow to steal the music of the sticks without the artist every knowing. The "perfect crime".

I mean we all know logically the weakness of prolink regarding the topic of file transfer. I think beat link trigger left the fingers out of this topic at least. Here it is served on the silver platter.

For example I made for fun a web interface around just these functionality using this library to play, browser and download tracks of connected CDJs. Everything is easy to get running with AI nowadays. Demo: https://www.instagram.com/stories/highlights/18115695487897693/

I think it was a wrong choice to put this out for everyone without talking about the security implications ...

I am not sure how the vendor will fix this issue while maintaining backward compatibility. I would wish a confirm button on every load from the player with the stick for example but then all players need to be on an updated version. There can be many ideas how to fix. For now, nothing is safe and with this project, everyone could do it SINCE 9 YEARS: 6238fac

I mean at the end, its the issue of the protocol and the issue is also there if there is not a library that make is easy to abuse.

I propose to remove the functionality from the latest versions until there is a fix on device and protocol level.

[flesniak]

Hi @erhan-,

this project started as tinkering with the ProDJ Link protocol and exploring what is possible. Naturally, this also includes potentially evil activities. An actual use-case for this tool popped up later when talking to lighting guys, but there is no original use-case that the tool was designed for. Focus could have also shifted to building actual CDJ player software for PC, where downloading files is essential for playback.

The download function was the result of classic reverse engineering. Replicating what the players do (downloading tracks) is the natural first step to implementing a client compatible with the CDJ's NFS dialect. This eventually lead to the discovery of client-side library parsing, which is used by this tool and others (like beat-link-trigger) to work on 4-deck setups. The download button just stayed there as a remnant of the early days.

I'm fine with removing the button as countermeasure to potential misuse. I believe that the impact is negligible though, since, as you mentioned, anyone with actual bad intentions might recreate that funtionality quickly with any AI tool. The project is maintenance mode for years now and I don't have time to work on it right now, but I'm open for pull requests addressing the issue.

I'm wondering how the vendor is trying to improve the situation though. Unauthenticated NFS access needs to remain for compatibility with older players. Maybe they restrict to IP addresses of valid players. This could lead to both this project and beat-link-trigger not being able to parse the database anymore. Falling back to the DBClient protocol can lead to rendering and playback issues on the players, esp. on 4-deck setups. Let's see.

[erhan-]

The idea of building the actually software sounds great and some people are also doing it nowadays. I think I saw some projects which look very similar to the CDJ software. I forgot the name or I would link it.

I agree that I cant think of an easy way to fix this. I thought maybe a visual indicator would at least help which shows when / which file is currently downloaded from the players stick. But I dont think any update will happen.

Thanks for taking your time to answer.