I can guess they'd so something like a unique URL that expires quickly and checks the user agent/headers/other stuff. Like all of this kind of stuff, it won't be bulletproof, but it'll be good enough. I'm sure I'm missing some other option that's better, though.

Exactly. It's easy to record a Flash stream too. Nothing is bulletproof.

There's no DRM with the current Flash iteration either. They use blowfish to obfuscate the audio URLs in the XML playlists, but the audio files themselves are standard unencrypted AAC/MP3 downloaded over HTTP.

The blowfish keys are easily grabbed after an update, it is off course a cat and mouse game, but overall pianobar and other stand-alone clients seem to be doing fairly well at keeping up.

I don't listen to music using the flash interface anymore, the biggest problem is that after just an hour or two of listening the flash application is using a HUGE amount of memory and is hogging one of my cores at 90%. Flash on Mac OS X was never anything to write home about ...