stupid_asshole69 [none/use name]

Oh fuck I didn’t actually answer your question! Sorry!

You want the two major private trackers for music. They both have active communities and all kinds of groupings of releases.

You have to have the cookie for squid dot wtf first. Go there.

You have two problems, curation and piracy.

Piracy is easy, get into a few good private trackers or download from YouTube or use soulseek (carefully!).

Curation is harder and if you don’t want to do it yourself you have to make friends with people who are into the same music as you or use the tools of feed based services like Spotify to dump into your piracy rube-Goldberg contraption.

It’s worth not doing the latter because you will end up failing the Dow Jones and the Industrials test if you just stick to only what the machine gives you because it’s what you like.

Go make friends with people and enjoy music, a collaborative hallucination unique to humanity, with them.

Users of the automated arr torrent and usenet stack have been complaining about malicious fake releases on public trackers which hit before the content street date and contain esoteric archive files that can run a program upon unpacking for maybe the last month or so.

The files are automatically downloaded by the users software because they match the users profile for that movie or series.

The users are mad that the devs told them to stop using trackers that distribute malware rather than the devs agreeing to implement filtering.

The only reason old archive formats are being deployed in that attack is because most antimalware doesn’t pay attention to them. Almost every modern archive format can at least open a link when processed but even the software that the users os calls to perform the operation has some kind of interlink built in to prevent that from happening without user awareness.

So there are currently malware crews actively and successfully targeting piracy networks and software.

Many years ago, one vector for mp3s other than extension-fu was embedding clickable links in the id3 data so that when displayed in Winamps playlist a user would accidentally or inquisitively make contact with some server. I first encountered this on soulseek.

There are also circumstances where extension-fu isn’t required. You can test this out on your own system by making a copy of some standalone program and renaming it with a wrong extension (say, .mp3 for instance!) then trying to open it.

Yt-dlp is the usual answer. There’s a script for when people have song chapters someone linked as well as the surprisingly decent mp3split-gtk, also already referenced.

Speaking as a soulseek user, be careful. You are now manually deciding what users you will accept data from with only the validation and security your computer or you yourself provide. It is incredibly easy to look up desirable rare recordings and create believable dummy files with a payload.