71–80 of 113 posts
Earlier quoted context omitted.
I would advise against this on pure UX grounds due to the existence of Valve the game software company.
They could name it after a type of valve. Stopcheck.js has a nice ring to it and seems kind of apt here.
If you’re YouTube or any site, and want to stop these sort of wrappers - what’s the easiest way to do so without breaking your own site? I find this task to be an interesting engineering problem. A related question is if there’s an unspoofable way to detect a client.
Found it:
https://moderncrypto.org/mail-archive/messaging/2014/000780....
Cool project but I wonder if the name will catch flak from the lawyers. Trademarks and all that. At they very least a big "This is not affiliated with Google/Youtube" seems like a wise precaution.
Love this Q&A: Do I need an API key to use this? No, YouTube.js does not use any official API so no API keys are required.
Earlier quoted context omitted.
Every few requests put up a catchpa. That is how google did it for their search https://support.google.com/websearch/answer/86640?hl=en
Wouldn't there be all sorts of human detection that they could do, similar to how game cheat engines work? A human is going to move the mouse across elements, drag, poke the screen, be slow, etc, and all in fairly predictable ways. Some API calls almost certainly require human interaction, where some interaction graph could be feed as a key to the API. It's cat and mouse, but at some point the mouse is going to get t…
Earlier quoted context omitted.
And that would totally not infringe on anything else, right.
It probably wouldn't, because it would be clear that it's got nothing to do with Valve the gaming software company. Trademarks aren't blanket coverage of any possible uses of a name.
PS: Nice here refers to the French town (compare to Berne Convention, Geneva Convention, Treaty of Paris), not the common meaning in English.
Earlier quoted context omitted.
Keep changing the implementation, keep changing names, keep changing the API formats. I'm definitely curious if there's a way to do a rotation that resists easy automatic code analysis.
Facebook does something similar to combat adblockers. They mangle the names of div elements to make sponsored posts indistinguishable from friends/group posts. I'm not aware of any browser plugins which are effective at blocking FB ads. Anyone know if other websites put as much effort into anti-adblock engineering?
Earlier quoted context omitted.
Any software you use might steal your YouTube credentials. It might be this API wrapper or it might be any other dependency. It might even be the scientific calculator you installed that had nothing to do with that project. What makes this especially scary?
Technically nothing can be trusted e.g. can anyone trust their silicon, wires, device drivers, compilers, OS, routers, SSL CAs, etc.? Trust has to happen at some point. The difference is that it's trivial for this developer to insert a backdoor to steal Google credentials since they know exactly how and where the oauth tokens are located. It's significantly harder for e.g. a webpack developer to insert a backdoor to…
So does all the malware: your browser's cookie store