Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 108 posts

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#81

Post by kmeisthax »

gruez wrote: post #53
asveikau wrote: post #32

The heuristics powering this, as well as the Windows Defender whitelisting, are terrible. My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem. Users are not incentivized to use the program with the warning. But removing the warning requires many people to ignore the warning. This is a big problem for anyone writing Windows software. A…

>My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem. Given the recent npm axios compromise this sounds like a pretty smart move?

The relevant heuristic in NPM supply-chain compromises would be the age of the specific binary. i.e. a freshly released package is riskier than one that's been around for a few days. So perhaps the policy should be that NPM doesn't install new package versions unless they've been public for 24 hours, or there's a signed override from the package repository itself stating that the update fixes a security issue. Of course, that would also require the NPM team have a separate review process for signing urgent security fixes.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#82

Post by kencausey »

whateverboat wrote: post #72
asveikau wrote: post #32

The heuristics powering this, as well as the Windows Defender whitelisting, are terrible. My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem. Users are not incentivized to use the program with the warning. But removing the warning requires many people to ignore the warning. This is a big problem for anyone writing Windows software. A…

This is also happening on linux for me.

Don't make statements like this without more explanation. In what way is this happening to you specifically? What distribution and platform are you using? Did you explicitly install something to warn you about 'side-loading' executables?

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#83

Post by kmeisthax »

nslsm wrote: post #52
ddtaylor wrote: post #41

Earlier quoted context omitted.

Google has been anti yt-dlp before it was forked. They also have rules that carve out tools like this from their extension store and at Android, except enforcement is lacking sometimes. Google is terrified of users having access users control to their video content.

yt-dlp breaks YouTube’s DRM. They could easily get the repo removed under the DMCA. They don’t.

Weirdly enough, Google's never actually made a public statement that YouTube "has DRM". If they did, it would immediately give Kevin McLeod the biggest copyleft trolling opportunity in history, because all Creative Commons licenses specifically forbid using DRM on the resulting work.

The only reason why we even know YouTube "has DRM" is because third parties have been able to plausibly allege DMCA 1201 circumvention claims against yt-dlp regarding a nebulously named "rolling cipher". These are not actual court findings of fact, just that you can say this in a legal filing and not immediately get your case thrown out on summary judgment. Which is a really low bar. Whether or not the rolling cipher actually qualifies as DRM is still an open question.

The way DMCA 1201 is written, basically anything intended to function as copy protection is considered DRM under the law. Like, those really annoying no-right-click scripts people used to put on sites probably could be argued to be DRM under DMCA 1201. However, in this case, there's a disconnect between the people offering the DRM (who don't actually claim it's DRM) and the people using it as DRM.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#84

Post by ddtaylor »

kmeisthax wrote: post #83
nslsm wrote: post #52

Earlier quoted context omitted.

yt-dlp breaks YouTube’s DRM. They could easily get the repo removed under the DMCA. They don’t.

Weirdly enough, Google's never actually made a public statement that YouTube "has DRM". If they did, it would immediately give Kevin McLeod the biggest copyleft trolling opportunity in history, because all Creative Commons licenses specifically forbid using DRM on the resulting work. The only reason why we even know YouTube "has DRM" is because third parties have been able to plausibly allege DMCA 1201 circumvention…

Google has consistently maintained in legal proceedings and terms of service that its technical measures, specifically its "rolling cipher" and signature mechanisms, constitute technological protection measures under the DMCA.

The most prominent public declaration of this stance occurred during the legal battle over youtube-dl (basically the ancesor of yt-dlp). While the RIAA initiated the initial 2020 DMCA takedown, Google's own technical implementation of the "rolling cipher" was the core of the argument.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#85

Post by cess11 »

faangguyindia wrote: post #30

It's funny such a big corporations can't let such a small tool live. Google is such an evil company, it is not even provided anything great anymore. Anti-gravity paid plans suck, GCP is billing heavy. Today google sucks at most things Their Android playstore hardly updates statistics once a day, so much for such a big data company with unlimited sources lol

It's a tool used to build other tools, some of which have non-trivial amounts of users.

It's also a tool used by e.g. journalists and government agencies that dabble in stuff like research and evidence, and it would probably be more cumbersome for everyone involved if Google instead had to process requests and provide copies of material for these purposes.

Otherwise they'd probably have made life much harder for the yt-dlp-developers already. Not that I think they're nice in any way, but I don't think they're seriously trying to fully eradicate yt-dlp or related software.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#88

Post by 1bpp »

nslsm wrote: post #52
ddtaylor wrote: post #41

Earlier quoted context omitted.

Google has been anti yt-dlp before it was forked. They also have rules that carve out tools like this from their extension store and at Android, except enforcement is lacking sometimes. Google is terrified of users having access users control to their video content.

yt-dlp breaks YouTube’s DRM. They could easily get the repo removed under the DMCA. They don’t.

IIRC the old yt-dlp was removed at one point for exactly that.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#89

Post by rjh29 »

socalgal2 wrote: post #70

This entire thread it almost entirely proof that HN is now reddit. No facts, no consideration, just accusation and crowd think > Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. none of that here > Don't be curmudgeonly. Thoughtful criticism is fine, but please don't be rigidly or generically negative. not followed here > Please respond to the strongest plausible interpret…

"a Google hater mis-interpreting something and the posting ragebait." Isn't exactly a thoughtful comment either. It's exactly the kind of no facts baseless accusation that you claim to be tired of seeing.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#90

Post by csomar »

asveikau wrote: post #32

The heuristics powering this, as well as the Windows Defender whitelisting, are terrible. My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem. Users are not incentivized to use the program with the warning. But removing the warning requires many people to ignore the warning. This is a big problem for anyone writing Windows software. A…

I found out a similar thing with my website being blocked by corporate firewalls. You need to create profiles at these cyber companies and then wait for whitelisting so that they can drop the ban.
Post reply on HN