Yt-dlp: External JavaScript runtime now required for full YouTube support

Post by zahlman » Wed, Nov 12, 2025, 9:32 PM UTC

arbll wrote: post #102

djoldman wrote: post #18

From https://github.com/yt-dlp/yt-dlp/wiki/EJS it looks like deno is recommended for these reasons: > Notes > * Code is run with restricted permissions (e.g, no file system or network access) > * Supports downloading EJS script dependencies from npm (--remote-components ejs:npm).

It's fine for this project since google is probably not in the business of triggering exploits in yt-dlp users but please do not use deno sandboxing as a your main security measure to execute untrusted code . Runtime-level sandboxing is always very weak. Relying on OS-level sandboxing or VMs (firecracker & co) is the right way for this.

Post by jcalvinowens » Wed, Nov 12, 2025, 9:39 PM UTC

PuercoPop wrote: post #418

recursive wrote: post #259

Earlier quoted context omitted.

I use YouTube on a daily basis. I haven't seen any of these problems.

It is likely you use Chrome or a browser that uses Blink for its engine and the OP uses a non-blink browser like Firefox. I use Firefox and I can cofirm since the last few months Youtube usability borders on usable

Post by immibis » Wed, Nov 12, 2025, 9:47 PM UTC

jorvi wrote: post #467

PuercoPop wrote: post #418

Earlier quoted context omitted.

It is likely you use Chrome or a browser that uses Blink for its engine and the OP uses a non-blink browser like Firefox. I use Firefox and I can cofirm since the last few months Youtube usability borders on usable

They've also started to be really aggressive against VPNs. I've tried Private Internet Access, Mulvad and AirVPN and often I have to cycle through 5-15(!) servers before YouTube stops saying "sign in to confirm you're not a bot". Discord has started to become absurdly aggressive with it too, to the point that they don't even let you load messages whilst logged in if you're on a VPN. It really makes me feel like there…

Post by immibis » Wed, Nov 12, 2025, 9:48 PM UTC

metalliqaz wrote: post #457

tuhgdetzhh wrote: post #452

Earlier quoted context omitted.

Only if you use Googles Chrome Browser. Other browsers have issues like Firefox[1]. [1]: https://news.ycombinator.com/item?id=41379517

I can no longer watch videos on YouTube with Firefox. When Firefox dies, the last glimmer of hope will go out.

Post by zelphirkalt » Wed, Nov 12, 2025, 9:51 PM UTC

jcalvinowens wrote: post #118

alex7o wrote: post #52

Earlier quoted context omitted.

They find devices that are easy to hack (and I mean rip and tear) and extract the decryption keys from each of them, from what I have heard cheap chinese tvs and set top boxes, they extract the keys from the chips (hardware hacking, heard some even use microscopes to read the keys by hand), and then use them to decrypt streams, I heard that they catch them pretty fast to they use like 1 device per season. This is why…

The really shitty thing is that vulnerable devices get blacklisted en masse, so all legitimate users get stuck with 480p video content on streaming services. The Nexus 5 got this treatment, as I understand it, because it was too easy to extract the keys.