Recent Happenings
I was but a wee lad in that fateful year 2007 when our house got access to the Internet. It was not, of course, the first time I had been online, but it was the first time this technology fell under my dominion, and getting it there had not been easy.
My mom was uneasy about the Internet’s corrupting powers, but truth be told, money was always the real deciding factor: the slowest connection available cost 36 American dollars per month, or roughly five full days of minimum wage Paraguayan labor that could be better spent elsewhere. Complicating matters, Paraguay’s relaxed relationship with zoning had allowed a tall concrete structure to install itself next to our house, interfering with the necessary radio waves. Nonetheless, my mom finally succumbed to my relentless pressure and approved the installation of a ridiculously tall antenna above our roof.
I came back from school one day to find that our house now looked like a robot’s head. This ominous sight appropriately signaled our transition into a new digital era. Yet the occasion was soured by the fact that, to make the cost palatable, my mom had struck an agreement with our neighbor: two houses would share an advertised “64kbps” connection. For context, dear reader, this is 1/7800 of the 500Mbps median connection you would enjoy in the United States today.
On a good day, my downloads reached eight kilobytes per second. When the neighbors browsed the web, that number often fell below one. Most of you never had to grapple with this ugly reality. For a teenager hungry for Japanese cartoons, <1kB/s quickly induced a state of terminal self-preservation, which led me to learn about concepts like 192.168.0.1 and network throttling because, providentially, the router was in our house. In times of great need––like when there was a new FMA release, I even dared unplug their cable.
The grim obelisk above our house gave me access but not abundance. I could only download files while not using the computer, i.e., the idle hours between the moment I went to sleep and the moment I returned from school. In perfect conditions, I could retrieve somewhere between 56.25 and 225 megabytes, and such a limited budget forced me to be judicious about what traveled through the antenna. Games were an almost impossible task because anything above a gigabyte was simply too risky. I defied this limit once to download World of Warcraft and was quickly smited. On the seventh day, lightning struck the metal rod above our house and incinerated my surge protector along with my downloading ambitions. If I wanted a game, I walked downtown and paid $31.
Audiovisual content was trickier to procure. The downtown kiosks carried a decent Hollywood selection and, if fortune accompanied you, the DVD you bought would indeed contain the film you wanted. It could also contain footage recorded in a theater by someone with bodily tremors, a chronic cough, or a seat behind a disproportionately large head. It could be dubbed, cropped, mistitled, missing its ending, subtitles belonging to another movie, or simply be the wrong thing altogether. Beyond the blockbusters, downtown vendors often had a thin foreign catalog, so if you wanted Great Teacher Onizuka JP-ES, you needed the Internet.
Online files suffered from the same maladies as pirated discs bought in plastic sachets, but by 2007 the people arranging them had developed better systems of quality control. This revealed the basic truth that governs the rest of this history: if you wanted a larger catalog and some confidence in what you were getting, somebody had to do more work and the system needed to give that person a reason––status, access, money, or some combination of the three––to keep doing it.
Pirating is laborious
Movie piracy predates the Internet. Prints were projected without authorization, broadcasts were recorded, VHS tapes were duplicated, and people trafficked bootleg discs. The Internet did not invent unauthorized copying. It did, however, break the job into components that could be performed by different people in different countries.
A usable pirated movie movie requires several jobs. Someone must obtain a source (e.g., a recording, broadcast, screener, VHS tape, DVD, Blu-ray, or a file leaked from somewhere closer to production). Someone must prepare it by extracting or capturing the video. They then must compress it using a codec. A codec is the set of rules used to compress the video and later reconstruct it for playback. Digital video contains a lot of information: uncompressed 720-by-480 color video at thirty frames per second consumes roughly 31 megabytes every second, or more than 220 gigabytes for a two-hour movie. Compression looks for repetition between frames, represents predictable information more efficiently, and discards details the viewer is unlikely to notice. The same is true for audio codecs. Depending on the codecs and the era, this is a time- and CPU-consuming process and the distinction mattered greatly for consumers: it determined whether I would watch one or three episodes when I came back from school.
The file also needs a title, year, artwork, cast, episode number, and other metadata. Someone must make a particular release findable and someone must store or transmit the bytes. If one company performs all jobs legally, pays for the rights, and charges your card every month, we call it a streaming service. Otherwise, the jobs are split across different people and groups operating at different layers and with different incentives.
Those layers matter because piracy did not evolve in a straight line from downloads to streaming or from centralized systems to decentralized ones. Each generation rearranged the same burdens in response to three pressures: people wanted less friction, operators wanted distance from legal responsibility, and somebody had to pay for servers, bandwidth, and development. Centralization usually improved search, consistency, and monetization while creating a company, domain, or server that could be sued or seized. Decentralization spread cost and risk while returning work to the user.
The history that follows can therefore be read as a succession of bottlenecks. None of these systems solved piracy but each tried to remove the most pressing obstacle.
The scene: sourcing releases and inventorying the metadata
Early digital piracy circulated through bulletin-board systems, private FTP servers, IRC channels, Usenet groups, and a competitive network of release groups collectively known as “the scene.” Release groups competed to obtain material and circulate it quickly, but speed was only one part of their reputation. A competently prepared release had craft: the right source, sensible compression, correct aspect ratio and audio, consistent naming, release notes, and sometimes checksums.
Discovery presented a different kind of problem. Before somebody could look for a particular copy, they first needed a centralized catalog. IMDb, was one approach to solve this issue. Volunteers did the clerical work of cataloging films, actors, etc. in much the same way that Wikipedia cataloged knowledge.
“I have produced a set of Unix scripts to create a movie database using the information on the lists. They make it easy to search for all appearances by an actor/actress or all the cast and director of a particular movie and are available by email if you missed them.” Col Needham
IMDb illustrated the need for and the cooperative production of metadata that later interfaces would rely on. The catalog answered what exists but an index that answered where a particular copy could be found had yet to appear. Who would host it?
The Napster model: catalogs + p2p
Napster’s key innovations were discovery and distribution. Its central service maintained a directory of the files users said they possessed. And, rather than one person shouldering the costs of hosting, people shared the files from peer-to-peer. When one person selected a result, the file traveled from one user’s computer to another’s which allowed the service to offer an enormous catalog without paying to host an enormous library. The architecture joined centralized discovery to decentralized storage, thereby removing much of the friction that had kept the masses away.
The Napster model was extended beyond music to software like KaZaA and Ares Galaxy. There were still three big problems, though. First, the file you clicked download on could arrive as described. But it could also arrive as porn, malware, or a bold combination of both, courtesy of xXDragonLord666Xx. Users tolerated this for the same reason we tolerated the three-dollar DVDs downtown: occasional betrayal was priced into the experience, and the legitimate market was insufficient to satisfy consumers’ needs. Two, your download experience was dependent on one computer. If the source had a slow connection, the receiver downloaded slowly; if the source disconnected, the receiver practiced either patience or cultivated enduring resentment. Three, the centralized discovery created a chokepoint that law enforcement could disrupt. How would they fix these problems?
BitTorrent: efficient p2p + reputation
Many projects were keen on addressing the centralization problem and by this time, a few tools appeared to enable downloads from multiple computers, but BitTorrent is really the one that made this efficient. As described in my previous post, the BitTorrent protocol allowed a downloader to retrieve different pieces from many peers at once. As soon as a peer obtained a piece, that peer could offer it to somebody else. A popular release could therefore gain distribution capacity as more people joined instead of merely overwhelming the original uploader. As a downloader, this meant faster and more consistent downloading speeds since there was a chance that the computers that you were downloading from were now located in Brazil or Argentina.
To fix the mismatch between files and metadata emerging torrenting sites adopted reputation systems, like reviews and star ratings. Comments could warn that a release had bad audio, burned-in subtitles, malware, or 120 minutes of an unrelated film. Trusted uploader badges and recognizable release groups turned names into brands like EVO or FLUX. Private trackers pushed this further through invitations and strict rules that made continued access conditional on adequate behavior. Public indexes maximized reach; private ones traded reach for quality, reliability, and governance.
Torrenting, however, still had a few problems during this era. The financial incentives in public trackers wasn’t great. Sites like The Pirate Bay captured the advertising revenue from everybody who visited the site but the uploaders were, at best, getting clout. While many release groups remained decidedly noncommercial, other operators resorted to sketchier ways of making money, like creating botnets. For example, a Windows license was prohibitively expensive for an average household in Paraguay so 99.9% of all licenses in the country were pirated2. We, as a country, had simply internalized piracy as a reality and saw people who paid for digital goods as chumps. Miscreants took advantage of this and shipped tainted copies of Windows and other software to be to millions of computers to profit from their files, bandwidth, and computational resources. They could harvest credentials, ship browsers with bogus search engines, rent the bandwidth as residential proxies, or rent them to anyone who needed denial-of-service attacks.
Nonetheless, BitTorrent achieved enduring technical and cultural impact. ‘Til this day torrenting is alive and well and many of the communities that began during this era still exist. However, the prospect of “viruses” and “malware” along with an increasing amount of threatening letters sent out by internet service providers deeply scarred the psyche of normies. Consumers demanded a safe, or at the very least more convenient, experience. And, creators wanted worthwhile financial incentives.
Cyberlockers: better incentives + less sketchiness
RapidShare, Megaupload, FileServe, and other cyberlockers brought the files back onto centralized web servers. An uploader placed a file with the host and received a link; forums, blogs, and linking sites allowed users to find the files. For downloaders, the centralization helped bring back legitimacy. If an account you trusted posted a Megaupload link in a forum you frequented then you had some confidence that the file was what it was supposed to be. For uploaders, cyberlockers offered straightforward rewards programs allowing for more honest monetization.
Cyberlockers’ business model was a master class in scarcity, incentives, and growth. Users experienced friction and inconvenience. When trying to download a file you would see countdowns and advertisements. Then, when downloading the file the speed would be throttled and parallel downloads were not allowed. You paid to make these inconveniences disappear. Cyberlockers recognized these inconveniences mattered primarily to developed countries. 100kB/s downloading limit? Great, best I could in Paraguay was around 20kB/s anyway. So, these sites increasingly forced you watch ads and wait until you could download your file if you were from the developing world and tried to make you pay for a subscription if you were from the upper echelons.
However, these things wouldn’t matter if you didn’t have a way to attract users to your site. To attract files, uploaders were paid around one dollar for every thousand downloads, along with other bonuses and incentives. The host needed popular files to attract free users, ads, and premium subscriptions, so it paid the people who brought those files.
Cyberlockers were insanely successful early-Internet ventures. Kim Dotcom, the founder of Megaupload, acquired luxury cars and mansions and cultivated a notorious online figure. However, this paradigm was beginning to crack under scrutiny from the federales and uploaders’ greed. Uploaders began employing numerous dark patterns to maximally extract money from downloaders. They would wrap download URLs in numerous layers of link shortening services. To uncover a the download URL, you would click on a link, watch ads, click on the new link, watch more ads, and eventually, you would reach the final download link to discover that the file was split in 12 parts.
On January 2012, New Zealand police raided the Kim Dotcom’s mansion at the request of American authorities, while the United States seized Megaupload’s domains and charged its operators with criminal copyright infringement, racketeering, and money laundering. Prosecutors alleged that the business had generated more than $175 million and placed particular emphasis on its rewards program and relationships with third-party linking sites. The shock changed the conduct of the entire sector: competing hosts eliminated affiliate programs, restricted public sharing, or withdrew. This story became a painful reminder of the risks that come with centralized distribution. The ecosystem never recovered and also became illustrative of how enforcement could alter an ecosystem through deterrence.
Ok, so back to decentralization then, right?
Cuevana: centralized streaming + bulletproof hosts
By 2011, my neighborhood had received ADSL cables and I could pull something like 250kB/s on a good night. Codecs had continued to improve and more homes had faster Internet speeds. Streaming was increasingly appealing and sites like Soundcloud became emblematic of this era. By this time, companies like Apple had somehow managed to convince people that it made sense to pay for media on iTunes and that making it stupidly difficult to sync your own (often pirated) media library to their devices was a good thing. Their proposition was, why own the media? Why bother downloading files? Ew, just click play.
The Internet was shifting towards a streaming paradigm and before the cyberlockers were taken down they had already began rolling out features like Megavideo, which allowed you to stream the files directly on your browser without having to download them.
Cuevana, which emerged in Argentina around 2009, made this transition especially visible in Latin America. It presented a searchable catalog of movies and television shows, subtitles, and browser playback, connecting them to video held on third-party hosts rather than storing every title itself. Putlocker and a proliferating collection of movie and television portals applied variations of the same arrangement elsewhere. The site selected a host and began playback. Cuevana’s innovation was that it could control the index and the experience while depending on another layer for the expensive and legally-exposed work of hosting.
To pay the bills, such websites employed increasingly invasive ads saturated with pop-ups, pop-unders, redirects, fake Play buttons, phony browser extensions, notification subscriptions, scams, and eventually scripts that treated a visitor’s processor as a tiny crypto mining rig––the likely culprit of your computer fans spinning really fast.
The key gamble that sites like Cuevana made was that, you could spin up hosts with content faster than they could be taken down by the authorities. Hide the digital bits in places like Bucharest and Chișinău and by the time they pull the server rack migrate it to Reykjavik or Skopje. Make the search expensive. Force them to do “international cooperation” and justify their expensive bills to the taxpayers: “Has the FBI become the personal army of Hollywood? Who cares if some urchin from the barrios of Buenos Aires is watching Breaking Bad? They could never afford it anyway!”
Indeed, but this sensible reasoning did not stop the manhunt. The original Cuevana developers successfully distanced themselves from the heat as lawsuits emerged, and one of them even got recognized as an Innovator under 35. The streaming model was here to stay, however, and many sites today still use the Cuevana model (including many modern Cuevana copycats) despite the legal risk. But, could the hosting be more robust? And, is there a way to monetize this rather than a bazillion invasive ads?
Popcorn Time: torrent-to-stream
Popcorn Time appeared in 2014 with an answer to the hosting question. Abiding to the streaming model, it displayed a polished grid of movie posters, selected a torrent behind the scenes, retrieved the pieces required for immediate playback, and passed them to an integrated player. The viewer experienced streaming while the application participated in BitTorrent. A centralized video host no longer needed to hold the entire catalog, yet the viewer no longer had to manage torrent files and wait for a download before watching. Popcorn Time’s innovation was to add a better UX to a tried and true distribution technology.
While the underlying host became decentralized, the project itself still was a centralized point of failure. So, within days of its launch the original developers withdrew amid legal pressure (from the MPAA). They had, however, released the source code, allowing unrelated teams to produce forks and successors. As more people re-packaged Popcorn Time, it was harder to keep up with potential malicious forks. Technical users could navigate this landscape, but the masses simply wanted to open a website and click play. For <$10 dollars a month, Netflix and Spotify were increasingly attractive, even for kids who swore to never pay for digital goods. The lesson of the 2010s was that companies largely defeated piracy through convenience. Could pirates still compete?
Kodi: agnostic software + “loaded boxes”
One advantage that pirates had over subscription services was quality. Real audiovisual enthusiasts are not satisfied with streaming services. The best way to take advantage of your Ultra HD 4K 7.1 Dolby setup is to have a Blu-ray disc. The biggest problem, though, is that you need to buy said discs.
There’s a burgeoning ecosystem that grew to accommodate thrifty enthusiasts, enabling anyone to build a serious home AV software and hardware stack. I figured we would cover this next week in a practical guide which lets you appreciate all the moving parts that go into this process.
Kodi entered this history as one component of AV enthusiasts’ stack. It began as XBMC, a media center for the original Xbox, and evolved into general-purpose open-source software for organizing and playing local files, network storage, and online sources. Kodi itself did not provide a pirated catalog, but its extensibility allowed third parties to add new interfaces and sources. This meant that you could assemble a very capable Fire TV alternative that allowed you to stream pirated content. However, this process was tedious and required maintenance (e.g., finding new sources, replacing broken add-ons, etc.).
Where there’s inconvenience there’s money to be made. People began selling fully configured Kodi boxes––cheap Android-based devices––so a consumer did not have to understand codecs, repositories, domains, or streaming hosts because the seller assembled and configured the thing for you. Most sellers are not happy with just earning the measly margins––some few dollars per box. Instead, miscreants engineered new ways to monetize the fact that they were selling you a computer that lived in your network. Recent investigations show that boxes such as these perform ad fraud (by pretending to be real phones clicking on ads), sell your bandwidth to whoever needs to hide their traffic under a clean IP address, and likely also sell your viewing habits. In 2025, BadBox 2.0 botnet had compromised more than ten million uncertified Android-derived devices, including television boxes, tablets, and even projectors.
But this is not Kodi’s fault. Kodi is simply one of the media players that people use to ship these malware TV boxes. Remarkably, the courts agree. Unlike Popcorn Time, Kodi was able to successfully distance itself from pirates and vendors who used its name to sell these “fully loaded boxes.” In the EU’s 2017 Filmspeler decision, the Court of Justice concluded that selling and advertising a multimedia player preconfigured to make unauthorized streams easy to reach could itself amount to an unlawful communication to the public, but the media player (Kodi) and the same player sold as a magic piracy appliance were not necessarily the same legal object.
Kodi is still used today and its legal-tested software model (i.e., providing the media player separate from add-ons that enable the pirating action) has set the precedent for the current era. But Kodi is not a website, just a tool that can be extended––albeit with sometimes sketchy add-ons––to use torrents underneath. If someone wants to click and play, where do they go?
Stremio: modular software with less privileges
Stremio, born in 2015, adopts a similar software philosophy of separation. Stremio orchestrates catalogs, metadata, streams, subtitles, and playback through add-ons that speak a documented protocol. Stremio itself is not an illegal streaming service, and its official materials distinguish official add-ons from independently developed community add-ons.
Stremio created is a modular software system that avoids legal problems in the same way that Kodi did: add-ons engaging in things like “PIRACY” are not sanctioned by Stremio. However, the decisive advantage is that Stremio add-ons operate as remote web services rather than extensions you install locally (like in Kodi’s case).
A quick explainer on software privileges: Where the code is executed determines the privileges it has. When malicious code lives in the firmware or at the operating system level it can essentially do whatever. That’s why operators can do so much when they sell you the sketchy TV boxes that they configured. And that’s why downloading a copy of Windows that someone tweaked is also risky. When you install software, its privileges are more constrained, but some risk remains. That’s why many people are not keen on installing Kodi add-ons. Even though Kodi itself may be clean (since its source code can be audited), the add-ons may not. Lastly, this is why installing Stremio itself is no problem, the source code is open. And, on top of that, its add-ons don’t need to be installed, they are just reached with network requests.
Software modularity is a form of decentralization. If one add-on disappears, the application can remain; if one index is blocked, another may answer the same class of request; if the playback client is neutral, its developer can distance the product from the independent services a user elects to install.
Anyway, technical details aside, how does Stremio allow you to watch pirated stuff? Basically, you the same model: you select and add-on and configure the torrents from where you are getting the files. Not much has changed, except there’s been a recent innovation. Torrent-based streaming can be a bit unreliable and slow for certain movie/show releases because it depends on seeders. To address this, something that has become popular again are “debrid services.”
Back in the cyberlocker era, debrid services offered a bridge. Rather than purchasing a subscription to Megaupload, Rapidshare, and others, you pasted the URL to a debrid service and it gave you access to the file without the inconveniences (i.e., the countdown, the ads, the limits). Debrid services essentially cached the files from these different cyberlockers and gave you a unified subscription. Eventually, debrid services also began retrieving data from torrents. Today, you can think of a debrid service almost like an “CDN edge server” which means a server that is close to you and has guaranteed faster speeds. Combined with a media player like Stremio or Kodi, this means almost instant playback!
Debrid services usually charge a subscription. Given everything we have covered in this post so far, this pricing model is sensible. Without this subscription, operators would need to make money in ugly and underhanded ways. Instead, acknowledging the distribution costs and risks incurred by the operators, the fee makes sense. Modern piracy has recreated the convenience and monthly fee of a streaming subscription. Rather than paying separate memberships to Netflix, Apple TV, Hulu, HBO, Disney+, etc. for fractured catalogs, you instead pay a smaller fee for a larger catalog obtained through illicit means.
However, debrid services one again bring centralization into the picture to make match the user experience provided by modern streaming services. Will these services survive the legal pressure?
What changed and where we are now
Each architectural iteration solved some bottlenecks and tested the boundaries of legality and users’ expectations. The scene specialized in sourcing and preparation while distributing releases through private hierarchies. Napster and Ares joined a central directory to to files held by users. BitTorrent made the audience contribute bandwidth and storage, while public and private trackers developed different systems of discovery and trust. Cyberlockers centralized the bytes, rewarded popular uploaders, and sold relief from artificial inconvenience. Cuevana joined a catalog and browser playback to external hosts. Popcorn Time buried peer-to-peer mechanics beneath a commercial interface; Kodi made the player extensible. Stremio made catalogs, streams, and subtitles interchangeable remote components; debrid providers re-centralized retrieval in exchange for speed.
These are different answers to a small set of questions. Who finds the movie, who stores it, who sends it, who establishes its quality, who organizes it for the screen, and who pays? They are also different allocations of risk both for users and operators. Centralized systems tend to be easier to use, easier to monetize, and easier to target. Decentralized ones tend to survive longer while requiring more judgment from users. Modularity can preserve a neutral component and make services replaceable, but it can also make the total arrangement harder for the user to inspect.
The largest change, then, is not that piracy moved cleanly from downloading to streaming or from amateur communities to organized businesses but that it molded itself to appease consumer expectations of speed, convenience, and perceived safety, even though this required increasing layers of abstraction and less visibility into each layer.
Piracy once offered control and demanded labor; its most consumer-friendly forms now offer convenience and demand trust. Along the way pirates pioneered and applied many innovative concepts. They created reputation markets, premium lanes, uploader economies, private communities, advertising supply chains, specialized hardware, automations, remote caches, television boxes, and numerous forms of cybercrime. Movies stayed the same but the systems around it adapted, filled gaps, and exploited opportunities, and whenever one arrangement failed, its surviving parts returned with a new product or scheme ran by either money-hungry operators or ideologic zealots under the banner that all digital media should be free.
Adjacent Reading
I think you read enough :^)
Unfortunately, I had to learn that games like World of Warcraft were harder to buy as pirated copies because they required multiple discs, serial keys, and access to official servers.
Source: me.