Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Youtube.js – full-featured wrapper around YouTube's private API

github.com

Post reply on HN
Print view View original

31–40 of 113 posts

Re: Youtube.js – full-featured wrapper around YouTube's private API

#31

Post by lostmsu »

comprev wrote: post #24
samisupset wrote: post #13

Earlier quoted context omitted.

Keep changing the implementation, keep changing names, keep changing the API formats. I'm definitely curious if there's a way to do a rotation that resists easy automatic code analysis.

Facebook does something similar to combat adblockers. They mangle the names of div elements to make sponsored posts indistinguishable from friends/group posts. I'm not aware of any browser plugins which are effective at blocking FB ads. Anyone know if other websites put as much effort into anti-adblock engineering?

FB Purity seems to be keeping up. But it is not a general purpose adblocker.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#32

Post by freedomben »

cphoover wrote: post #28

I'm surprised they still support video dislike via API, but have removed it from the user interface... I understand they are likely worried about backwards compatibility with the abundance of client-devices, and not inadvertently breaking some app somewhere, but why not just make it a noop... Unrelated: My treadmill has the absolute worst YT client I've ever used.

My understanding was that they still want to hoover up that sweet sweet preferences data (of which dislike is a useful metric). It's just not going to be exposed externally.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#33

Post by tshaddox »

cphoover wrote: post #28

I'm surprised they still support video dislike via API, but have removed it from the user interface... I understand they are likely worried about backwards compatibility with the abundance of client-devices, and not inadvertently breaking some app somewhere, but why not just make it a noop... Unrelated: My treadmill has the absolute worst YT client I've ever used.

YouTube hasn’t removed the dislike button. They have removed the dislike count.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#34

Post by freedomben »

endisneigh wrote: post #10

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

It's probably impossible to stop it, but you could make it pretty painful by aggressively breaking/changing the API contract. You could maximally engage human ID and fingerprinting techniques and CAPTCHAs, or do machine learning on usage patterns to find likely bots and ban them if you're willing to accept that false positives will hurt innocent customers. Whatever you decide to do, it won't be free because it will also hurt your own devs (such as making it harder and more complex to work on). Obviously your own devs can have advance notice for changes, but it's still a pain to deal with.

Overall though, I would seriously ask why? Anti-cheat for a game maybe? It will cost you time/money to prevent, and it will hurt people that like your product enough to hack on it. As a user who rejoices in having APIs I can use to automate products I like, I'd be far more likely to pay you if you have an API I can use.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#35

Post by freedomben »

xyst wrote: post #26
endisneigh wrote: post #10

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

So a form of DRM on the APIs themselves? It wouldn't be easy. How would you determine if the request is originating from an official YT developed app (iOS, Android, ...) or client (YouTube.com); or a non-approved client? I suppose you can have a system which works like TOTP except for machine-to-machine. Although it would probably be broken since anything on the client side can be disassembled. The UX would likely su…

I think the best you could do is attempt detection/fingerprinting, but I don't think it's possible to stop it since you never have full control of the client.

I once saw a certificate-based implementation once where the server issued a temporary x509 cert to the client and then used mTLS[1]. It did reduce "unauthorized" clients by raising the bar, but it ended up making life way harder for their devs and the people they really wanted to stop just implemented the cert strategy and moved on.

[1]: https://freedomben.medium.com/what-is-mtls-and-how-does-it-w...

Re: Youtube.js – full-featured wrapper around YouTube's private API

#37

Post by smrtinsert »

endisneigh wrote: post #10

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

Require request tokens. Authorized clients would have some sort of generator, anything else would fail to execute.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#38

Post by Tenoke »

cphoover wrote: post #28

I'm surprised they still support video dislike via API, but have removed it from the user interface... I understand they are likely worried about backwards compatibility with the abundance of client-devices, and not inadvertently breaking some app somewhere, but why not just make it a noop... Unrelated: My treadmill has the absolute worst YT client I've ever used.

They do and you can install extensions to see the dislike count though sadly they slow down my experience every time Ive tried them (at least on Windows Chrome).

Re: Youtube.js – full-featured wrapper around YouTube's private API

#39

Post by trinovantes »

chmod775 wrote: post #8
trinovantes wrote: post #2

I'm always nervous about 3rd party API wrappers. It's basically saying "Here's the keys to my (users) Google account, please don't do anything bad". Even if it's open source, there's no guarantee there's no malicious change in version x.x.N+1

Any software you use might steal your YouTube credentials. It might be this API wrapper or it might be any other dependency. It might even be the scientific calculator you installed that had nothing to do with that project. What makes this especially scary?

Technically nothing can be trusted e.g. can anyone trust their silicon, wires, device drivers, compilers, OS, routers, SSL CAs, etc.? Trust has to happen at some point.

The difference is that it's trivial for this developer to insert a backdoor to steal Google credentials since they know exactly how and where the oauth tokens are located. It's significantly harder for e.g. a webpack developer to insert a backdoor to steal Google credentials since they would have to first determine the code it's processing is handling oauth tokens and then figure out where they are stored.

The barrier to entry is the key in assessing your threat model. 3 letter agencies may not care about the cost if the target is valuable but a bored kid on the other side of the world will give up pretty quickly.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#40

Post by etra0 »

Tenoke wrote: post #38
cphoover wrote: post #28

I'm surprised they still support video dislike via API, but have removed it from the user interface... I understand they are likely worried about backwards compatibility with the abundance of client-devices, and not inadvertently breaking some app somewhere, but why not just make it a noop... Unrelated: My treadmill has the absolute worst YT client I've ever used.

They do and you can install extensions to see the dislike count though sadly they slow down my experience every time Ive tried them (at least on Windows Chrome).

You cannot longer see the true like/dislike ratio. They removed the dislike count even from the API since December 13th [0]. The extension does some guesswork to calculate that for you [1].

This library also doesn't give you the dislikes anymore (just tested it).

[0] https://support.google.com/youtube/thread/134791097/update-t...

[1] https://github.com/Anarios/return-youtube-dislike#what-it-do...

Post reply on HN