This user agent could just be set to the official client's user agent and nobody would see a thing, this is a free text field basically.
Then it would be more of an exercise of finding clients behaving in an odd way that's not mapping to an official client. That's way harder to detect though.
Trying to pretend to be an official client was a game I never wanted to play. There's so many tiny differences in the way I've implemented the protocol it would be trivial for Spotify to notice this if they wanted to. It then becomes an whack a mole game between them and us.
Spotify is fully aware of librespot and has tolerated it so far. If they change their minds are try to block it it would be the end of the road for librespot. This is why, despite repeated requests from users, librespot has never supported free accounts nor downloading files in order to avoid pissing Spotify off. I always knew it would be trivial for anyone to implement this using the librespot source code, but it makes me a bit sad someone actually did it.
(That being said, I personally don't contribute or use librespot anymore, so really I don't care)
I wonder if this is somewhere it would make sense to use a non-free license which restricts how people use the code or what modifications they are allowed to redistribute. It wouldn’t stop anyone motivated from breaking the rules by themselves but it makes things like Oggify less likely to be distributed and so would mean librespot might be more likely to survive long-term.
This is the curse of open source - once you put the code out there, there's nothing you can do about it.
Currently dealing with this with a project of mine, it's hard to see people take and "abuse it", but there's nothing you can do really - licenses don't stop anyone.
Sorry these were meant as two separate points. People have asked repeatedly to use librespot on free accounts, and (other) people have asked to have librespot download files. I've pushed back on both, and Oggify does the later only.
Then it would be more of an exercise of finding clients behaving in an odd way that's not mapping to an official client. That's way harder to detect though.