Live data from Hacker News

Youtube.js – full-featured wrapper around YouTube's private API

github.com

11–20 of 113 posts

Re: Youtube.js – full-featured wrapper around YouTube's private API

#11

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

Provide a public API (charge for it if you have too). The videos on YouTube are the property of the creators, not YouTube.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#12
It would be great if this had a CLI tool, so that it could be used as an alternative to yt-dlp. Or a web frontend as an alternative to Invidious, which breaks more often than not.

That said, I wouldn't be surprised if Google issues a C&D, or just inevitably breaks it, especially if it uses undocumented APIs.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#13

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

Keep changing the implementation, keep changing names, keep changing the API formats.

I'm definitely curious if there's a way to do a rotation that resists easy automatic code analysis.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#15

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

Given the power of Google they may be able to force you to sign in after watching a few videos.

Or only serve videos if they detect some kind of physical input(mouse/keyboard)

But they don't seem to care that much for non-mainstream tools, or this would be blocked already

For small scale sites it's definitely not easy to block

They may be some paid libraries that promises to do it, but I've never seen one that seemed really unbreakable

Even if you go all the way and block EVERY possible way of doing this, you can make a puppeteer script that could watch and record sound/video directly on the screen in like 15 lines of code, even if it would be really slow to get long videos

Re: Youtube.js – full-featured wrapper around YouTube's private API

#16

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

The only bulletproof way is to change your business model to make these useless, irrelevant or no longer threatening. Yours and the user’s incentives should be aligned.

If you serve content, put it behind a paywall and rate-limit based on the maximum amount a human can reasonably consume and stop caring whether the user uses your own client or something like this - after all you’re getting paid either way.

The only businesses that are threatened by unofficial API clients are cancerous “growth and engagement” crap where the “value” is the wasting of the user’s time. Don’t be such a business and you’ll be fine.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#17

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

Keep changing the implementation, keep changing names, keep changing the API formats. I'm definitely curious if there's a way to do a rotation that resists easy automatic code analysis.

you don't even have to look at the script, just at the network requests

you'd basically have to make your own stealthy video format, otherwise you can just catch network requests

Re: Youtube.js – full-featured wrapper around YouTube's private API

#19

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

Provide a public API (charge for it if you have too). The videos on YouTube are the property of the creators, not YouTube.

YouTube already has a public API

Re: Youtube.js – full-featured wrapper around YouTube's private API

#20
post #14

Cool project but I wonder if the name will catch flak from the lawyers. Trademarks and all that. At they very least a big "This is not affiliated with Google/Youtube" seems like a wise precaution.

They should rename it to Innertube.js (which is the official name of the private API, and as far as I know not trademarked not used in any user-facing resources).
Post reply on HN