From Yahoo! Media Player

YMP gets its playlist from links in the web page in which it is contained. Sometimes this is inconvenient for the publisher, who wants to make music available for streaming but not downloading. How can a publisher conceal direct links in order to make it harder for users to download?

One strategy is to keep the link out of the visible web page only. A user who wants to view source can still find the download link. Ways to do this include:

No content in your anchor: <a href="example.mp3"></a>

Hiding your anchor with CSS: <a href="example.mp3" style="display:none"></a>

Another strategy is to put the link in an external playlist. A user who wants to view source, grab the playlist URL, fetch the playlist, and look inside the playlist can still find the download link. Ways to do this include:

Use an XSPF playlist: <a href="example.xspf">my playlist</a>

Put your link in an external web page and scrape it with the "playthispage" keyword: <a href="example.html" class="playthispage">my playlist</a>

Another idea related to hiding links would be to leave all the media file links out of the markup, then write them into the DOM via JavaScript. If you execute this script before page load completes, the links will be visible to the player when it does its parse, but will not be visible to users who view the source of the document. The links will, of course, still be visible to power users who utilize something like Firebug to view the DOM, but it should effectively obfuscate the links from average users.

Another strategy is to expire URLs, so that the media URL in the web page can only be used once or can only be used for a short time. This goes in the direction of the world of encryption and more aggressive security, which is out of scope for this article.