Tracked - the last two weeks in DJ tech and culture, curated from inside the booth. The latest: AlphaTheta’s PRO DJ LINK vulnerability and what it actually exposes, XDJ-AN reviewed, three new Mixxx mappings, and the DVS story told by people who were there.
🔬 The Breakdown #
Where the headline and the reality part.
PRO DJ LINK has an open file server - but not in the way “major security hole in CDJs” makes it sound
On 8 August AlphaTheta confirmed a vulnerability in PRO DJ LINK affecting rekordbox and a long list of CDJ and XDJ models. The finder, San Francisco DJ and developer Chris L (Triode), has published his own account: PRO DJ LINK moves music over NFS, that server accepts an arbitrary file path, and its authentication is a hardcoded value in the header. In rekordbox it starts with Link Export. On a CDJ-3000 or XDJ-AZ it starts at boot. So on a computer that means any file on the drive; on a player, any file on the stick.
How concerned you should be: the attacker has to be on your network. Ethernet between players in a booth is fine. The real exposure is wireless - Link Export over Wi-Fi, mobile rekordbox, venue networks you did not configure. CDM’s Peter Kirn calls it AlphaTheta’s MCAS moment, and that holds: a feature working exactly as engineered, on by default, without the safety framing to match. Note what is not on the affected list - DJM mixers, Stagehand, PRO DJ LINK Bridge, most older gear. This arrived with networking.
Testing: update rekordbox from inside the app instead of clicking past the prompt, check your model against the status page (it moves as firmware ships - trust it over any list, including this one), keep sensitive files off your gig stick, and leave Link Export off unless you need it.
The sources:
- AlphaTheta’s notice and live response status: the only list that stays current. Read the notice → · Check your model →
- CDM: the careful breakdown of scope, with Triode’s full technical explanation. Read via CDM →
- Digital DJ Tips: the short version, if you want one link to forward. Read via Digital DJ Tips →
🎧 General DJ #
From Final Scratch to Serato: DJWorx retells the DVS story from inside it Skratchworx covered Final Scratch, Serato Scratch Live and Traktor as they landed, and DJWorx has now turned twenty years of that archive into a history of DVS told as it happened rather than reconstructed. DVS was the last time DJs were asked to trust a new layer of technology between the record and the speakers - the arguments about reliability and lock-in will sound familiar after the item above. Read it on DJWorx →
Also worth your time:
- The five things new DJs struggle with most: Crossfader asked its community what actually tripped them up starting out, then answered each one. Read via Crossfader →
- The Camelot Wheel, without the theory: harmonic mixing for people who never learned the circle of fifths. Vendor-published and it steers toward Lexicon’s tooling, but the explanation is sound. Read via Lexicon →
⚙️ Hardware #
AlphaTheta XDJ-AN, reviewed by MusicTech - the cheapest way into a standalone rekordbox rig, and you can feel where the money went 7/10. A club-style layout, fully standalone, at €1,149 / £999 / $1,199 - less than a decent laptop plus controller. The compromises are the interesting part: one USB-C media port mounted on the rear, no USB-A, no booth output, no Key Sync, and Sync, Slip, Quantize and Vinyl all buried in a seven-inch touchscreen. The crossfader has a half-centimetre dead zone either side. Weigh it against the XDJ-RR it replaces, which had more dedicated controls for the money. Read the review on MusicTech →
And someone just built the standalone AlphaTheta didn’t A UK DJ has bolted a Traktor Kontrol S2 to a frame of 1515 aluminium extrusion, hidden a screenless MacBook Air M3 underneath, and added a 10.5-inch screen, an integrated battery and two Intech Studio PBF4 modules for dedicated stem faders. Claimed 8+ hours unplugged, balanced outs, and barely more footprint than a CDJ - the brief was cramped booths and a fast pack-down. Still a prototype, specs unverified. But the Intech modules are open hardware, schematics and Gerbers on GitHub, so this is reproducible rather than a one-off. Read the build thread →
Check out:
- Decksaver’s latest run of covers: a new batch of lids from Mixware across current gear. Unglamorous, but dust retires more controllers than obsolescence does. See the range →
🌐 Software & Open Source #
Three more controllers get mapped, and a skin mod pushes Mixxx to 32 hotcues The Mixxx community are still pumping out controller mappings since our last edition. A FaderFox DJ3 mapping has landed with working scripts and MIDI XML - pitch on the up/down faders, turntable-style - with the author upfront that the LEDs are unsolved. The Traktor Kontrol X1 MK2 HID mapping has reached v2.1 with bank toggling for hotcues 5-8. A Numark Mixtrack Go thread is open. And someone has modded the stock LateNight skin to show 32 hotcues.
The threads:
- FaderFox DJ3 - manual pitch control: Read the thread →
- Traktor Kontrol X1 MK2 HID mapping v2.1: tested on 2.5.6 stable, partially on the 2.7 alpha. Read the thread →
- Numark Mixtrack Go mapping: Read the thread →
- LateNight skin mod with 32 hotcues: Read the thread →
Also in the open-source column:
- An AutoDJ script that mixes on acoustic power, not linear fades: re-engineered from Byron Xu’s original, following what the developer describes as the empirical rules of acoustic power and harmonic mixing. Untested by us, but a genuinely different approach to a feature most DJs write off. See the repo →
- Still own a Novation Twitch? Apple Silicon testers wanted: the code is written, nobody has the discontinued controller to test it on. Answer the call →
That’s Tracked for this week. #
Tracked is published free, but subscribers get it the moment it drops:
(Always free. No spam, unsubscribe in one click.)
