Yt-dlp: Upcoming new requirements for YouTube downloads

Post by ForHackernews » Wed, Sep 24, 2025, 1:46 PM UTC

supriyo-biswas wrote: post #63

ACCount37 wrote: post #49

Earlier quoted context omitted.

If you ever wondered why the likes of Google and Cloudflare want to restrict the web to a few signed, integrity-checked browser implementations? Now you know.

At least for YouTube, viewbotting is very much a thing, which undermines trust in the platform. Even if we were to remove Google ads from the equation, there’s nothing preventing someone from crafting a channel with millions of bot-generated views and comments, in order to paid sponsor placements, etc. The reasons are similar for Cloudflare, but their stances are a bit too DRMish for my tastes. I guess someone could…

Post by zelphirkalt » Wed, Sep 24, 2025, 1:47 PM UTC

progbits wrote: post #8

progbits wrote: post #4

Can anyone explain specifically what the YT code does that the existing python interpreter is unusable and apparently quickjs takes 20 minutes to run it? Is it just a lot of CPU-bound code and the modern JIT runtimes are simply that much faster, or is it doing some trickery that deno optimizes well?

From https://github.com/ytdl-org/youtube-dl/issues/33186 > Currently, a new style of player JS is beginning to be sent where the challenge code is no longer modular but is hooked into other code throughout the player JS. So it's no longer a standalone script that can be interpreted but it depends on all the other code on the site? Which could still be interpreted maybe but is a lot more complex and might need DOM etc…

Post by supriyo-biswas » Wed, Sep 24, 2025, 1:49 PM UTC

ForHackernews wrote: post #82

supriyo-biswas wrote: post #63

Earlier quoted context omitted.

At least for YouTube, viewbotting is very much a thing, which undermines trust in the platform. Even if we were to remove Google ads from the equation, there’s nothing preventing someone from crafting a channel with millions of bot-generated views and comments, in order to paid sponsor placements, etc. The reasons are similar for Cloudflare, but their stances are a bit too DRMish for my tastes. I guess someone could…

> which undermines trust in the platform What? What does this even mean? Who "trusts" youtube? It's filled with disinformation, AI slop and nonsense.

Post by Andrews54757 » Wed, Sep 24, 2025, 1:50 PM UTC

dylan604 wrote: post #71

Andrews54757 wrote: post #30

Nsig/sig - Special tokens which must be passed to API calls, generated by code in base.js (player code). This is what has broken for yt-dlp and other third party clients. Instead of extracting the code that generates those tokens (eg using regular expressions) like we used to, we now need to run the whole base.js player code to get these tokens because the code is spread out all over the player code. PoToken - Proof…

> For the web it requires that you run a snippet of javascript code (the challenge) in the browser to prove that you are not a bot. How does this prove you are not a bot. How does this code not work in a headless Chromimum if it's just client side JS?

Post by yolo_420 » Wed, Sep 24, 2025, 1:50 PM UTC

piyuv wrote: post #9

I’m a paying YouTube premium subscriber. Last weekend, I wanted to download something so I can watch it on my way in the train. The app got stuck at “waiting for download..” on my iPad. Same on iPhone. Restart did not work. I gave up after an hour (30 mins hands on trying stuff, 30 mins waiting for it to fix itself). Downloaded the video using yt-dlp, transferred it to my USB c flash drive, and watched it from that.…