Is the service you are using allow you to download the music DRM free, or is it only streamable?
If it’s the latter, might want to reconsider. Just like movies purchased on these platforms (Apple, Amazon, Microsoft, …), the license holder of the intellectual property (IP), usually the record/music company, can pull their content from these platforms at any time and you will not be reimbursed.
Kind of cool if your production infrastructure can match. But for most companies (ie, Fortune 500 and some medium companies) implementing this would need a force majeure.
Decades of software rot, change in management, change in architecture, waxing and waning of software and hardware trends, half assed implementations, and good ole bottom tier software consultation/contractors brought into the mix make such things impossible to implement at scale.
Once worked at a company where their onprem infra was a mix of mainframe, ibm / dell proprietary crap, Oracle vendor locked, and some rhel/centos servers. Of course some servers were on different versions of the OS. So it was impossible to setup a development environment to replicate issues.
For the most part, that’s why I still use docker for most jobs. Much easier to pull in the right image, configure app deployment declaratively, and reproduce the bug(s). I would say 90% of the time it was reproducible. Before docker/containerization it was much less than that and we had to reproduce in some non production environment that was shared amongst team.
True story. Next car I own will be a manual. Won’t even bother setting up the electronic junk if it comes with it.
Chromium should be gucci though
Based. Thanks for sharing these PRs. Will look over them.
This is the only way. Except some services don’t even accept those randomly generated ones. Only a slight inconvenience to add whatever special character they want or to trim the length.
In my opinion, the project would benefit from static vulnerability scanning. Low hanging fruit like this XSS would have definitely been flagged.
Most of those providers even give it out for free for open source projects. So it wouldn’t hurt.
Only in read only mode.
I just want to add a quick note:
From OPs screenshot, I noticed the JS code is attempting to extract the session cookie from the users that click on the link. If it’s successful, it attempts to exfiltrate to some server otherwise sends an empty value.
You can see the attacker/spammer obscures the url of the server using JS api as well.
May be how lemmy.world attackers have had access for a lengthy period of time. Attackers have been hijacking sessions of admins. The one compromised user opened up the flood gates.
Not a sec engineer, so maybe someone else can chime in.
.io, .org, and .app are pretty good.
.xyz for fun ideas.
.dev for the obvious
.corp if you are an incorporated company in the US.