Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yt-dlp: Upcoming new requirements for YouTube downloads

github.com

Post reply on HN
Print view View original

401–410 of 635 posts

Re: Yt-dlp: Upcoming new requirements for YouTube downloads

#401

Post by arbll »

hyperrail wrote: post #195
arbll wrote: post #12

Earlier quoted context omitted.

The sandboxing features of Deno also seem to have played a role in that choice. I wouldn't overly trust that as a security layer but it's better than nothing.

This is the first time I've heard of Deno so I'm only going by their Security & Permissions doc page [1], but it looks like the doc page at the very end recommends using system-level sandboxing as a defense in depth. This suggests that Deno doesn't use system sandboxing itself. To me this is a bit alarming as IIRC most app runtime libraries that also have this in-runtime-only sandboxing approach are moving away from…

Deno is a V8 wrapper, the same JS engine as Chrome. Vulnerabilities are very common there, not necessarily because it's poorly designed but more because there's massive financial incentives in findings them.

This plus what you mentioned is why I would never trust it to run arbitrary code.

Now in the context of yt-dlp it might fine, google isn't going to target them with exploits. I would still prefer if they didn't continue to propagate "DeNo iS SaFe BeCauSe It HaS sAnDbOxInG" because I've seen projets that were actually executing arbitrary JS rely on it thinking it was safe.

Re: Yt-dlp: Upcoming new requirements for YouTube downloads

#402

Post by arbll »

ndjddirbrbrbfi wrote: post #34
CuriouslyC wrote: post #20

Earlier quoted context omitted.

Deno sandboxing is paper thin, last time I looked they had very simple rules. It's a checkbox feature. If you want isolation use WASM.

It doesn’t have granularity in terms of what parts of the code have what permission - everything in the same process has the same permission, but aside from that I’m not sure what you mean about it being paper thin. Certainly WASM is a great option, and I think it can facilitate a more nuanced capabilities model, but for cases like this AFAIK Deno should be secure (to the extent that V8 is secure, which Chrome’s secu…

Chrome does not rely exclusively on V8's security or else it would routinely get exploited (See v8 CVEs if you don't believe me). The hard part of browser exploitation today is escaping from the os-level sandbox put on the processes that run each of your tabs.

Trusting Deno's sandboxing by itself isn't a great idea. An attacker only has to wait for the next V8 exploit to drop, probably a question of a few months at worse.

Now like I mentioned above it's probably ok in yt-dlp context, Google isn't going to target it with an exploit. It's still important that folks reading this don't takeaway "deno sandbox safe" and use it the next time they need to run user-supplied JS.

Re: Yt-dlp: Upcoming new requirements for YouTube downloads

#403

Post by ASalazarMX »

XnoiVeX wrote: post #184
est wrote: post #16

I really appreciate the engineering effort went into this "JavaScript interpreter" https://github.com/yt-dlp/yt-dlp/blob/2025.09.23/yt_dlp/jsin...

It's a subset of Javascript. HN discussion here https://news.ycombinator.com/item?id=32794081

This is amazing, an old school but effective approach in this modern age. I was afraid they were going to embed a browser.

Re: Yt-dlp: Upcoming new requirements for YouTube downloads

#404

Post by godelski »

fragmede wrote: post #365
godelski wrote: post #346

Earlier quoted context omitted.

I was talking to "my friend" about how I'm annoyed my calendar duplicates holidays because it imports from multiple calendars and he asked me "what value" would be provided if this was solved. Confused I said it pushes things off so I can't read events. He clarified he meant monetary value... We're both programmers so we're both know we're talking about a one line regex... I know quite a number of people like this an…

What did you tell him was the monetary value? Let's say there are like 5 holidays per year that result in days where some people have holidays but others do not, so business meetings happen that day that get missed. Let's say you have a 100 million people using this calendar software. Let's say 0.5 percent of those are in the executive class. Furthermore, let's say 10% of them miss a meeting due to this UI issue. Tha…

Sorry, let me clarify better (but it leads to similar issues)

On my iPhone[0] calendar I imported my Microsoft (work) and Google (personal) calendars, also having the iPhone calendar. If we take last Labor day as an example, if I don't disable the Holiday calendars in Microsoft and Google, I have 3 entries for Labor Day. Holidays sit at the top of the day so if I'm on my phone I basically won't see any other events. If I'm on my macbook and my Calendar is using 60% of my vertical space I see "Labor Day +3 more". Full screen I can see 4 maybe 5 entries....

So I can save a large chunk of real estate by doing a simple fucking 1 line regex. At the same time I can effectively merge the calendars, so I get to see the holidays that are in one but not the others.

Effectively, I can ACTUALLY SEE WHAT I HAVE SCHEDULED FOR THE DAY[1]

This, of course, also affects other things. Sometimes Google will add an event because I got an email later. Fuck, now I have dupes... Same thing happens with birthdays... Or you can hit that fun bug where you have for some god damn reason duplicate contacts with the same name, phone number, and birthday, you get triplicate calendar entries and merging[2] and results in quadruple entries!

I have missed so many fucking things because I didn't see it on my calendar[3]. And someone has the audacity to ask how much money would be saved? We've spent longer discussing the problem than it would take to fix it! These aren't junior people I'm talking to (who ask dumb things like "but I can't control or merge the other calendars" not recognizing it's a display issue), but like a L6 at Amazon.[4]

  > So, after estimating the number of ping pong balls that fit on a 747, the thing to do is to go write the regexp and put that on your promo packet.
I swear, the problem is no one realizes the point of leetcode questions was never to get the answers right, but to just have some problem for an interviewee work on and see how they go about solving it. I'd rather an engineer get the wrong answer with a good thought process than get the right answer with shitty code that was obviously memorized. It's much harder to teach people how to think than it is to teach them some specific thing to remember.

[0] I've almost immediately regretted this decision...

[1] General frustration yelling, not yelling at you

[2] No, the "find duplicate contacts" option does not in fact find duplicate contacts (what fucking data are they looking for? Because it sure as hell isn't identical names. Why isn't it even trying to do similar names?!)

[3] I've also missed so many fucking things because that little scroll wheel wasn't completely finished with its animation and so saved the wrong day or switched AM to PM. I've missed so many things because I have so little control over notifications and they disappear not if I dismiss them, but if I just unlock my god damn phone. So not just that one liner needs to be done, but it would do a lot and these other one-liners would also greatly help.

[4] Dude was complaining about candidates using GPT to do leetcode problems and how he had a hard time figuring out if they were cheating or not. One of my many suggestions was "why not do in person interviews?" which was answered with how expensive plane tickets were (his interviewees were local) and contradicted his prior and later statements about how costly it is to hire/interview someone. I'm sorry, what percentage of 6 engineer's salaries to do 6 interviews for an hour is a single round trip ticket for a domestic flight? Or to have someone... drive in...

Re: Yt-dlp: Upcoming new requirements for YouTube downloads

#405

Post by arbll »

nicce wrote: post #327
doctorpangloss wrote: post #288

Earlier quoted context omitted.

What evidence is there that Deno's "security and isolation" works? It's their application, yt-dlp can use whatever it wants. But they made their choices for stylistic/aesthetic reasons.

What evidence is telling the opposite? Scripts use V8 isolation, identical to Chrome. What comes to rest, we can only trust or review by ourself, but it is certainly better than nothing in this context.

Identical to Chrome except the part where Chrome uses os-level sandboxing on top. V8 exploits are common, Deno sandboxing by itself is not a good idea if you are executing arbitrary code.

Re: Yt-dlp: Upcoming new requirements for YouTube downloads

#406

Post by reflexco »

indymike wrote: post #379
godelski wrote: post #346

Earlier quoted context omitted.

I was talking to "my friend" about how I'm annoyed my calendar duplicates holidays because it imports from multiple calendars and he asked me "what value" would be provided if this was solved. Confused I said it pushes things off so I can't read events. He clarified he meant monetary value... We're both programmers so we're both know we're talking about a one line regex... I know quite a number of people like this an…

Hmm. If the annual subscription is $100 then the value of fixing this is $100. If it is free, then, what's the profile worth for a year... there's the value. User retention is a thing.

User retention is not much of a thing anymore thanks to the stickiness afforded by integrated services and network effects.

You can't just switch calendar/video streaming when everything else is integrated with it/everyone is exclusively posting on this network.

Re: Yt-dlp: Upcoming new requirements for YouTube downloads

#407

Post by icelancer »

piyuv wrote: post #9

I’m a paying YouTube premium subscriber. Last weekend, I wanted to download something so I can watch it on my way in the train. The app got stuck at “waiting for download..” on my iPad. Same on iPhone. Restart did not work. I gave up after an hour (30 mins hands on trying stuff, 30 mins waiting for it to fix itself). Downloaded the video using yt-dlp, transferred it to my USB c flash drive, and watched it from that.…

YouTube premium "download" is also just completely fake. Downloaded where? What file can I copy?

Re: Yt-dlp: Upcoming new requirements for YouTube downloads

#408

Post by einpoklum »

dotancohen wrote: post #385
einpoklum wrote: post #320

Earlier quoted context omitted.

Those days are not coming to an end: * PeerTube and similar platforms for video streaming of freely-distributable content; * BitTorrent-based mechanisms for sharing large files (or similar protocols). Will this be inconvenient? At first, somewhat. But I am led to believe that in the second category one can already achieve a decent experience.

To how many content creators have you written to request them share their content on PeerTube or BitTorrent? How did they respond? How will they monetize?

1. Zero

2. N/A, but enough content creators on YT are very much aware of the kind of prison it is, especially in the years after the Adpocalypse.

3. Obviously, nobody should be able to monetize the copying of content. If it is released, it is publicly released. But they can use LibrePay/Patreon/Buy me a coffee, they can sell merch or signed copies of things, they can do live appearances, etc.

Re: Yt-dlp: Upcoming new requirements for YouTube downloads

#410

Post by goku12 »

xnx wrote: post #391
wraptile wrote: post #58

Days of just getting data off the web are coming to an end as everything requires a full browser running thousands of lines of obfuscated js code now. So instead of a website giving me that 1kb json that could be cached now I start a full browser stack and transmit 10 megabytes through 100 requests, messing up your analytics and security profile and everyone's a loser. Yay.

It's an arms race. Websites have become stupidly/unnecessarily/hostilely complicated, but AI/LLMs have made it possible (though more expensive) to get whatever useful information exists out of them. Soon, LLMs will be able to complete any Captcha a human can within reasonable time. When that happens, the "analog hole" may be open permanently. If you can point a camera and a microphone at it, the AI will be able to ma…

Please remember that an LLM accessing any website isn't the problem here. It's the scraping bots that saturate the server bandwidth (a DoS attack of sorts) to collect data to train the LLMs with. An LLM solving a captcha or an Anubis style proof of work problem isn't a big concern here, because the worst they're going to do with the collected data is to cache them for later analysis and reporting. Unlike the crawlers, LLMs don't have any incentives in sucking up huge amounts of data like a giant vacuum cleaner.
Post reply on HN