Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Youtube.js – full-featured wrapper around YouTube's private API

github.com

Post reply on HN
Print view View original

41–50 of 113 posts

Re: Youtube.js – full-featured wrapper around YouTube's private API

#41

Post by skanga »

imiric wrote: post #12

It would be great if this had a CLI tool, so that it could be used as an alternative to yt-dlp. Or a web frontend as an alternative to Invidious, which breaks more often than not. That said, I wouldn't be surprised if Google issues a C&D, or just inevitably breaks it, especially if it uses undocumented APIs.

Its VERY easy to make one.

  1. Install NodeJS and NPM (if you don't already have it)
  2. Create a new folder
  3. Run "npm install youtubei.js@latest" in that folder
  4. Create a new file in this folder called ytdl.js (or whatever you like)
  5. See section "Downloading videos:" on the github page. Make the contents of the file exactly like that. i.e. just cut/paste that example.
  6. Replace line 'Looking for life on Mars - documentary' with the name of the youtube video you want to download (ideally this should come from args)
  7. Run "node ytdl.js" and it should download

Re: Youtube.js – full-featured wrapper around YouTube's private API

#42

Post by saurik »

ushakov wrote: post #25
bragr wrote: post #14

Cool project but I wonder if the name will catch flak from the lawyers. Trademarks and all that. At they very least a big "This is not affiliated with Google/Youtube" seems like a wise precaution.

they have a disclaimer below https://github.com/LuanRT/YouTube.js#disclaimer edit: why am i getting downvoted?

The disclaimer doesn't really matter, as 1) we wouldn't really expect that many people to read it and 2) it is going to get used in a ton of contexts without that disclaimer... such as in the headline of this Hacker News post. I can't make a company "Apple Computer Backstage" and just put a little note on my website that says "Apple Computer Backstage has no involvement with Apple Computer". This project simply should not have "YouTube" in its name... or, if it absolutely must, it at least needs to be on the other side of some kind of preposition. This insistence upon using other peoples' trademarks in the names of third-party clients based on adversarial interoperability--something that the company often has every reason to "throw the book at" as it is inherently hostile--is what ends up killing the vast majority of these projects over time. This isn't "in for a penny, in for a pound": you need to carefully choose your battles, and flagrantly violating someone's trademarks is going to be your weakest link as it is such low hanging legal fruit and doesn't actually buy you anything.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#43

Post by mediocregopher »

endisneigh wrote: post #10

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

There's no perfect solution, but you can make it painful. One solution I've seen, which only works in a server-side rendered site, is for the server to generate a random name for each form field being rendered. The mapping of random id to real field name is kept in the user's session information server-side, so the translation is then done server-side as well whenever the user performs an action.

At that point anyone writing a library like this would need to actually pull in the rendered page on which the user is supposed to be navigated, scrape the field names off of that (which won't be easy), and only _then_ could they perform the form action.

But if you're a big enough site, someone will likely still take the time to do it.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#44

Post by jokoon »

Sadly, I don't think it will let users view video that require login.

For example, some 6min show that goes on live french TV everyday got flagged and requires login to be viewed, for age reason.

Maybe there was curse words, or some butt-shaped thing in it?

Re: Youtube.js – full-featured wrapper around YouTube's private API

#45

Post by wvenable »

bragr wrote: post #14

Cool project but I wonder if the name will catch flak from the lawyers. Trademarks and all that. At they very least a big "This is not affiliated with Google/Youtube" seems like a wise precaution.

They should immediately rename it so as not to be caught the way YouTube Vanced was. A disclaimer is not a sufficient response to trademark issues.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#46

Post by Quentak »

jokoon wrote: post #44

Sadly, I don't think it will let users view video that require login. For example, some 6min show that goes on live french TV everyday got flagged and requires login to be viewed, for age reason. Maybe there was curse words, or some butt-shaped thing in it?

https://github.com/zerodytrash/Simple-YouTube-Age-Restrictio...

Re: Youtube.js – full-featured wrapper around YouTube's private API

#47

Post by wantlotsofcurry »

comprev wrote: post #24
samisupset wrote: post #13

Earlier quoted context omitted.

Keep changing the implementation, keep changing names, keep changing the API formats. I'm definitely curious if there's a way to do a rotation that resists easy automatic code analysis.

Facebook does something similar to combat adblockers. They mangle the names of div elements to make sponsored posts indistinguishable from friends/group posts. I'm not aware of any browser plugins which are effective at blocking FB ads. Anyone know if other websites put as much effort into anti-adblock engineering?

I think Workday does the same. Trying to scrape data from there was a nightmare (team didn't have api access).

Re: Youtube.js – full-featured wrapper around YouTube's private API

#48

Post by Bilal_io »

ec109685 wrote: post #29
endisneigh wrote: post #10

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

The demos have Node.JS examples. If that's the case, it doesn't seem possible to block. If it's running in a browser, Google can simply disallow those domains to make API calls. Also, at least Apple will block apps that make unauthorized API calls to third parties.

The agent can be faked.

There are CORS rules, but those are enforced by the browser, a backend cannot prevent you from calling it, except by requiring an access token or something similar.

Re: Youtube.js – full-featured wrapper around YouTube's private API

#49

Post by guessbest »

endisneigh wrote: post #10

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

Every few requests put up a catchpa. That is how google did it for their search

https://support.google.com/websearch/answer/86640?hl=en

Re: Youtube.js – full-featured wrapper around YouTube's private API

#50

Post by heavyset_go »

endisneigh wrote: post #10

If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.

Seems like a use case for remote attestation.
Post reply on HN