For me there are generally 3 steps to the process of watching a youtube video.
1. Get the video id. Retrieve HTML containing youtube /watch?v= urls or other urls that contain the video id. Extract the urls from the HTML or other markup garbage.
2. Retrieve the video. Feed the /watch?v= url to a script that does some "find and replace" on the absurdly long googlevideo urls. Below I have given an example of such a script. Complaints welcome. It takes a /watch?v= url on stdin and retrieves the video in the format specified on the command line.
3. Play the video. ffmpeg libraries, mplayer, etc.
Whatever it is Flash does in the process of watching youtube videos (I am quite sure it is not step 3), I do not need it.
Thus even if by not using Flash or a complex "modern" web browser to watch youtube videos somehow were to reduce my exposure to vulnerabilities that routinely occur in such software, I would not care. Because the reason I do not use Flash is.... because I do not need it.
# proof of concept: video retrieval
# requirements:
# sh, sed, tr, openssl, ftp
# Adobe Flash not required
# HTML5 not required
# Python not required
# Awk not required
# web browser not required
curl=ftp
file=1.mp4 # default outfile
url=www.youtube.com # example
# itag #s are on the wikipedia page for youtube
f061(){
sed '
s,%3D,=,g;
s,%3A,:,g;
s,%2F,/,g;
s,%3F,?,g;
s/
//g;
'
}
f060(){
sed -e '
s/&itag=5//;t1
s/&itag=1[78]//;t1
s/&itag=22//;t1
s/&itag=3[4-8]//;t1
s/&itag=4[3-6]//;t1
s/&itag=1[346][0-9]//;t1
' -e :1
}
f062(){
sed '
s,http,\
&,g'
}
f063(){
sed '
/%3A%2F/!d;
/videoplayback/!d'
}
f064(){
sed '
s,%26,\
,g;
s,&,\
,g;
'
}
f065(){
sed 's/&https/\
\
https/g;'
}
f066(){
sed 's/\\u0026.*//'
}
f067(){
sed '/itag='"${1-.}"'/!d;'
}
f068(){
sed 's/%25/%/g'
}
f069(){
tr '\012' '&'
}
f070(){
sed 's/&$//'; echo
}
f071(){
local a061 a062 a063;
while read a; do
case $a in
https://*)a061=${a#https://*/} ;;
http://*)a061=${a#http://*/} ;;
*)a061=${a#*/} ;;
esac;
a062=${a#*://};
a063=${a062%%/*};
printf "%b" "${1-GET} /${a061} HTTP/1.0\r\n"
printf "Host: ${a063}\r\n";
printf "User-Agent: GoogleAnalytics 1.5.1\r\n";
printf "Connection: Close\r\n";
printf "\r\n";
done;
}
f072(){
openssl s_client -ign_eof -connect $1:${2-443} -verify 9
}
case $# in
[12])
{
f071 \
|f072 $url \
|f062 \
|f063 \
|f061 \
|f060 \
|f064 \
|f068 \
|f069 \
|f070
} \
|f061 \
|f065 \
|f066 \
|f067 $1 \
|{
read a;
exec $curl -4o ${2-$file} $a ;
}
;;
*)
exec echo \
"usage: $0 itagno [outfile]
outfile: $file"
esac