Live data from Hacker News

Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

news.ycombinator.com

61–70 of 108 posts

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#62
post #53

The heuristics powering this, as well as the Windows Defender whitelisting, are terrible. My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem. Users are not incentivized to use the program with the warning. But removing the warning requires many people to ignore the warning. This is a big problem for anyone writing Windows software. A…

>My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem. Given the recent npm axios compromise this sounds like a pretty smart move?

How is it a smart move? Here, Microsoft is training users to ignore a security warning. If the same mechanism were added to NPM (that is, a warning that the package is suspicious and for the user to be extra sure they want it), users would have been trained to ignore any security warning issued for the compromised axios version (just like they had ignored it for all previous "clean" versions) and installed it anyway.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#63
post #5

The binaries they offer are complied using PyInstaller, which can give false positives in anti virus software.

Why would a browser(be designed to) care about this?

Because Google does no evol.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#66

Which is why I download it from my Linux distribution's package manager. It's available on Termux too.

Which in the case of yt-dlp might not be fast enough.

I use a telegram/mqtt/homeassistant wrapper (1) to let my mother download audiobooks which are saved in jellyfin so she can listen or download them from my (home)server.

Keeping yt-dlp up2date (and therefore) working is not that easy, especially since I dont systemupdate every other week. There were a few phases yt-dlp version in nixpkgs-unstable were just not working. I created a little wrapper that updates a venv so I always have the HEAD running for my bot.

[1] https://github.com/entropie/ytdltt

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#69

for what it is worth, when downloading the latest .exe from github, firefox says "this file is not commonly downloaded" and i have to select "allow download". scans of it are fine. probably just a heuristic-based false-positive, and not a news-worthy story of chrome abusing their monopoly or whatever.

Do these little speed bumps even work? I have to admit I'm so numb to all these popups and to apps warning me this and begging me that, that I just don't read anything anymore. Each app that hits me up with yet another dialog is just another brick in the wall.

The only speed bump that I find super annoying is when your browser tries to prevent you from going to a site with an incorrectly configured certificate (or a self signed certificate). The UX browsers make you navigate in this case is extra-horrible. Apparently, my use of a self-signed certificate for some local machines means I'm about to die.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#70
This entire thread it almost entirely proof that HN is now reddit. No facts, no consideration, just accusation and crowd think

> Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.

none of that here

> Don't be curmudgeonly. Thoughtful criticism is fine, but please don't be rigidly or generically negative.

not followed here

> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.

none of that there

> Eschew flamebait. Avoid generic tangents. Omit internet tropes.

Lots of that here

The system is clearly automated. As others have pointed out, they've been able to download without incident. As other have also pointed out, Firefox also warns. The warning is reasonable, claiming that something isn't downloaded often is true, until it isn't. A few more downloads and the warning will likely go away.

Nothing to see here except a Google hater mis-interpreting something and the posting ragebait.

Post reply on HN