Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

MacRumors

macrumors bot
Original poster
Apr 12, 2001
63,490
30,730



Last month, software engineer Naveed Golafshani created an unofficial Apple Music web player that allowed users to sign into their Apple Music accounts and listen to music on a laptop or desktop computer, without needing to open iTunes.

This is an addition to Apple Music that many subscribers have been requesting for years, and now another unofficial Apple Music web player has emerged online. Created by software engineer Brychan Bennett-Odlum and his team, Raphaël Vigée, James Jarvis, and Filip Grebowski, the new web player is called "Musish" [GitHub Link].

musish-3-800x591.jpg

Musish has an all-white design that closely mirrors the look and feel of Apple Music on iOS and macOS. Just like the previous player, Musish requires you to sign in to your Apple ID to be able to play music on the web, using Apple's official public APIs to handle authentication. This is handled in a separate window under the Apple.com domain, and Musish says at no point does it ever request, log, or gain access to user information.

Bennett-Odlum told us that he and his team are heavy Apple Music users, and the origins of Musish began at a hackathon event in San Francisco just last month.
We are all heavy users of Apple Music, but found listening at work hard as it drained our phones' battery lives and we didn't want to set up our Apple IDs on our work laptops.

We started Musish at a hackathon in San Francisco in early December after noticing the APIs Apple provide for the service and realising that it'd be a pretty nifty solution to the problem!
After logging in, Musish presents you the expected Apple Music tabs: For You, Browse, Radio, and My Library, although some are pared down compared to the full experience. For You has recently played songs, albums in heavy rotation, personalized mixes, the day's playlists and albums, and new releases. Apple Music's social features like friend profiles and "Friends Are Listening To" aren't available.

musish-4-800x591.jpg

Browse has top songs, daily top 100 playlists, top playlists, top albums, and a genres tab. Just like Golafshani's web player, Musish is missing Radio features at this time, but the site's developers promise that Apple Music Radio support is coming soon. If you're searching for a specific artist, playlist, or album, you can use the search bar at the top right of Musish, which remains open on every tab.

To play music, you simply click on the album/playlist you want to hear, and then click Play, Shuffle, or select a specific song. The Musish web player then places playback controls at the bottom left of the screen, where you can adjust the volume, turn on repeat, turn on shuffle, check out lyrics, and reorganize up next.

musish-2-800x591.jpg

In Musish, you can configure the order of up next to your liking by click and dragging songs, and you can find another song, hover over it, click the ellipsis button, and click "play next" to place it next in your queue, just like the regular Apple Music apps.

According to Bennett-Odlum, the team still has a ways to go until Musish reaches its full potential, including work on mobile compatibility, a dark mode, and a more populated Browse section. The team welcomes feedback and feature suggestions on the GitHub page for Musish, which is open source so anyone can contribute to the project.

It's been seven months since Apple was rumored to be working on its own official web player for Apple Music, but as of now nothing has come out of the company in this regard. You can check out Musish for yourself by following this link.

Article Link: Apple Music Gets Another Unofficial Web Player With Launch of 'Musish'
 
  • Like
Reactions: RandomDSdevel

Porco

macrumors 68040
Mar 28, 2005
3,315
6,909
They use Apples native API for authentification, so they actually never get to see your credentials as far as I understood.

One would certainly hope so, but I think people are right to be cautious about this.
 

Brodlum

macrumors member
Jun 14, 2018
38
22
Musish handles authentication directly in the browser using official Apple APIs. When a user clicks login on Musish a new browser window opens up under the Apple.com domain, once verified Apple sends the Musish web app a token which is then sent back directly to Apple in subsequent requests. This token only works for the scope of Apple Music, has a short expiration, and never leaves your web browser to anywhere other than an Apple server. Musish never log, request, or even receive this token outside of the user’s browser window.
 

Morgenland

macrumors 65816
May 28, 2009
1,476
2,204
Europe
They use Apples native API for authentification, so they actually never get to see your credentials as far as I understood.

And you enter your credential with the keyboard....
Keylogger is what Hackers use then.....
At least those "music lovers" might have integrated that.

"Musish never log, request, or even receive this token outside of the user’s browser window."
Never know.

A keylogger can be installed on your computer any number of ways. Anyone with access to your computer could install it; keyloggers could come as a component part of a virus or from any application installation, despite how deceptively innocent it may look. This is part of the reason why you should always be sure you’re downloading files from a trusted resource.
[https://www.veracode.com/security/keylogger]

Another method would be to program specific screenshots. Whoever loads this software is to blame.

On the other hand, there will be enough such people who always speak derogatorily about iTunes, and don't understand that it is a brilliant and runtime-optimized data management program, which is perhaps a bit overloaded, but generally brilliant.
I say this, even though I was sometimes very angry about some changes.
 
Last edited:

1050792

Suspended
Oct 2, 2016
2,515
3,991
And you enter your credential with the keyboard....
Keylogger is what Hackers use then.....
At least they might have integrated that. Never know.
They can't integrate that in Apple's own website used to enter your credentials. It's like purchasing something online and click the Pay Now button in which you get redirected to enter your card credentials, or even better the "Pay by PayPal" button.
 

tonyr6

macrumors 68000
Oct 13, 2011
1,736
732
Brooklyn NY
I already like this better than Play Apple Music.
Tried it but I don't know the bitrate. Play Apple Music lets you choose 256kbps LC-AAC which sounds great. However this web player gives you no option so too me it sounds more like a tin can most likely 64kbps HE-AAC akin like the horrible Youtube music.
 

chucker23n1

macrumors G3
Dec 7, 2014
8,533
11,284
And you enter your credential with the keyboard....
Keylogger is what Hackers use then.....
At least they might have integrated that.

"Musish never log, request, or even receive this token outside of the user’s browser window."
Never know.

A keylogger can be installed on your computer any number of ways. Anyone with access to your computer could install it; keyloggers could come as a component part of a virus or from any application installation, despite how deceptively innocent it may look. This is part of the reason why you should always be sure you’re downloading files from a trusted resource.
[https://www.veracode.com/security/keylogger]

Yes, but the password isn't actually entered in a site running Musish's code, so I don't know what you're getting at.
 

deadworlds

macrumors 65816
Jun 15, 2007
1,027
758
Citrus Heights,CA
Everyone worried about Musish stealing your Apple ID, you do realize this is an open source project right? Meaning that hundreds if not throussauds of people can look at and inspect the code. If there was ever any risk of shady behavior someone would find it and start making a fuss about it. That’s the wonders of having open source software. There is never a piece of code that is hidden from the public.
 

Brodlum

macrumors member
Jun 14, 2018
38
22
Tried it but I don't know the bitrate. Play Apple Music lets you choose 256kbps LC-AAC which sounds great. However this web player gives you no option so too me it sounds more like a tin can most likely 64kbps HE-AAC akin like the horrible Youtube music.

It should be playing in 256kbps, if it’s not then try refreshing. It should only reduce on low bandwidth.

We plan on adding a toggle switch for bitrate this week.
 

LordVic

Cancelled
Sep 7, 2011
5,938
12,458
They can't integrate that in Apple's own website used to enter your credentials. It's like purchasing something online and click the Pay Now button in which you get redirected to enter your card credentials, or even better the "Pay by PayPal" button.

it's been done before (not with apple yet, but never say never).

there have been several known attacks where a page has a payment/login link that is hijacked. the target looks and acts correctly, and even works, but the form records the data.

Newegg in 2018 got nailed with one, where you got to the proper payment processor page, but the frame forwarding was logging payment information to a 3rd party. Newegg didn't isntall this, but was the function of a nefarius hacked 3rd party.

online, the more hoops, links, and forwards you have to go through, the more liklihood of security issues occur. IMHO, if you are not directly on Apple's own site, I wouldn't be putting my iTunes credentials in at all.
 
  • Like
Reactions: Raist3001

trekkie604

macrumors 68000
Feb 25, 2008
1,675
1,204
Vancouver, Canada
And you enter your credential with the keyboard....
Keylogger is what Hackers use then.....
At least those "music lovers" might have integrated that.

"Musish never log, request, or even receive this token outside of the user’s browser window."
Never know.

A keylogger can be installed on your computer any number of ways. Anyone with access to your computer could install it; keyloggers could come as a component part of a virus or from any application installation, despite how deceptively innocent it may look. This is part of the reason why you should always be sure you’re downloading files from a trusted resource.
[https://www.veracode.com/security/keylogger]

Another method would be to program specific screenshots. Whoever loads this software is to blame.

If you have a keylogger on your computer you have bigger issues. If this uses the Apple's federated API then it should be fine.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.