Live data from Hacker News

Youtube.js – full-featured wrapper around YouTube's private API

github.com

101–110 of 113 posts

Re: Youtube.js – full-featured wrapper around YouTube's private API

#102

This is really cool, but maybe the README's disclaimer should also warn that using YouTube's private APIs is against their Terms of Service[0], specifically this section: The following restrictions apply to your use of the Service. You are not allowed to: (...) 3. access the Service using any automated means (such as robots, botnets or scrapers) except (a) in the case of public search engines, in accordance with YouT…

If Youtube exposed a real public API it'd be 1 week when someone makes a far better front to it. That's why it's not exposed.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#103
Worth noting that if you automate too much with this API, you'd be smart to not do it with a Google account you care about, or it'll get banned.

And they ban any accounts with matching recovery or verification phone numbers and email addresses too, or part of the same gsuite domain.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#104
post #96

Earlier quoted context omitted.

Seems like a use case for remote attestation.

Indeed. Yet another reason why we must rally against such efforts.

Yeah, it's not a future that I'm looking forward to.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#105
post #94

Earlier quoted context omitted.

> the APIs probably changes regularly I'd go as far to say routinely. A massive pain point for third party youtube apps like newpipe which break every few months due to it.

as it happens, newpipe is currently broken

0.20.2 is working for me (at least it's working enough that videos can be played and downloaded). Even in newpipe I prefer to download videos rather than stream them. VLC is a far better player, fewer ads, fewer distractions, zero comments, and what videos I re-watch and how often isn't being logged by google.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#106

Earlier quoted context omitted.

I don't see why YouTube would want to allow any of this; the APIs probably changes regularly, have documentation only available internally, and they can't attribute the use of these APIs to specific Client IDs for abuse (ie. bypassing rate limits by using these); this is not mentioning how there's $0 to gain from doing this, and it could actively cause them to lose money since the RIAA has DMCA'd even the mention of…

> the APIs probably changes regularly I'd go as far to say routinely. A massive pain point for third party youtube apps like newpipe which break every few months due to it.

As a regular user of NewPipe, I disagree that it's a "massive" pain point. NewPipe works very well almost all the time.

Coincidentally today is maybe the third time I've went to watch something and it's been broken. It's annoying yes, but soooo much less annoying that constant ads. It's a minor pain point that is easily solved by temporarily switching back to regular youtube.. by the time I've seen a few ads I'm more annoyed at the regular experience and NewPipe probably has a fix out by then anyway.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#107

Earlier quoted context omitted.

> Not every application runs in the browser We're talking about YouTube in this thread. > any injected frontend js would have to bypass browser's sandboxing to steal another domain's cookies i.e. a zero day which is beyond your threat model Where did this random unrelated attack vector come from? We're going talking about running untrusted software on your computer, remember? That's the attack vector we're discussing…

> We're going talking about running untrusted software on your computer, remember? You are talking about running untrusted software on your computer. This thread is about the "youtubei.js" npm package that is acting as a wrapper around YouTube's API. My point is it's trivial for this developer to add additional code to `youtube.signIn(creds)` that I'm calling vs. any developer of one of my dependency to inject code t…

> If it's frontend code

Since you cannot use youtube.js in a browser (because it's not supported & because of CORS checks would fail), we can only be talking about 'backend' code here.

Thus the comparison has to be with other backend dependencies and software running on your computer/servers.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#108
post #87

Earlier quoted context omitted.

Something like this lives or dies based on how much you annoy the people with lawyers to spare. Doesn't seem like the best plan.

Is there any better plan in an era where the real currency is attention?

I doubt having the project named after youtube is that important for attention.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#109

Earlier quoted context omitted.

Is there any better plan in an era where the real currency is attention?

I doubt having the project named after youtube is that important for attention.

The attention comes from the stories that happen after they leak the C&D that Alphabet is going to send them for naming it after youtube, then quickly roll out a rename.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#110

Earlier quoted context omitted.

I doubt having the project named after youtube is that important for attention.

The attention comes from the stories that happen after they leak the C&D that Alphabet is going to send them for naming it after youtube, then quickly roll out a rename.

Well ... good luck to them I guess. That does not sound like a plan I'd personally enjoy.
Post reply on HN