Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 108 posts

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#71

Post by whateverboat »

socalgal2 wrote: post #70

This entire thread it almost entirely proof that HN is now reddit. No facts, no consideration, just accusation and crowd think > Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. none of that here > Don't be curmudgeonly. Thoughtful criticism is fine, but please don't be rigidly or generically negative. not followed here > Please respond to the strongest plausible interpret…

You are wrong. There is at least one collaboration here that I can see. Download any other `.tar.gz`, Chrome says nothing. Do it with `yt-dlp`, chrome says it can harm your computer. Why?

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#72

Post by whateverboat »

asveikau wrote: post #32

The heuristics powering this, as well as the Windows Defender whitelisting, are terrible. My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem. Users are not incentivized to use the program with the warning. But removing the warning requires many people to ignore the warning. This is a big problem for anyone writing Windows software. A…

This is also happening on linux for me.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#73

Post by whateverboat »

john_strinlai wrote: post #15

for what it is worth, when downloading the latest .exe from github, firefox says "this file is not commonly downloaded" and i have to select "allow download". scans of it are fine. probably just a heuristic-based false-positive, and not a news-worthy story of chrome abusing their monopoly or whatever.

This is also happening with `.tar.gz` file on chrome for yt-dlp. Doesn't happen for other `.tar.gz`

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#74

Post by burnte »

pimterry wrote: post #54
Frotag wrote: post #49

Earlier quoted context omitted.

Conveniently M$ lets you buy a signing certificate to fix this. https://stackoverflow.com/questions/48946680/how-to-avoid-th...

EV no longer skips smartscreen either nowadays. I understand that was abused, so it's treated as the same as OV. Having a certificate allows the cert itself to accumulate trust (rather than each binary independently doing so) and provides better UX and I suspect an initial small boost to trust signal, but doesn't bypass the initial distrust. There's no way to avoid that AFAICT and even if you're an established busine…

> EV no longer skips smartscreen either nowadays. I understand that was abused

EV was always going to be abused. It started out promising to be a human verified, $10k cert that meant you were GUARANTEED to be who it said you were. Now I can get one for a couple hundred bucks.

The solution is to separate identity from encryption. They never should have been linked.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#75

Post by Meekro »

I tried to reproduce this on their download page for the latest release[1]. Only the windows exe gets the warning, the other releases (macos, linux, etc) all download just fine. That makes me think it's an automated system that messed up, not an attempt at anticompetitive behavior.

[1] https://github.com/yt-dlp/yt-dlp/releases/tag/2026.03.17

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#76

Post by kivle »

exe34 wrote: post #56
nslsm wrote: post #52

Earlier quoted context omitted.

yt-dlp breaks YouTube’s DRM. They could easily get the repo removed under the DMCA. They don’t.

it'll just cause a lot more people to become aware of it and cause mirrors to pop up everywhere.

RIAA already tried to take down the Github repo for youtube-dl (basically the original yt-dlp was forked from) back in October 2020. But outcry from among others EFF got it reinstated just one month later. Google is probably on the fence about this because they saw how it went last time. The slow killing of adblockers in Chrome seems to be something they are getting away with, so maybe that will make them bolder once things have moved along far enough that there's no way back.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#77

Post by asveikau »

pimterry wrote: post #54
Frotag wrote: post #49

Earlier quoted context omitted.

Conveniently M$ lets you buy a signing certificate to fix this. https://stackoverflow.com/questions/48946680/how-to-avoid-th...

EV no longer skips smartscreen either nowadays. I understand that was abused, so it's treated as the same as OV. Having a certificate allows the cert itself to accumulate trust (rather than each binary independently doing so) and provides better UX and I suspect an initial small boost to trust signal, but doesn't bypass the initial distrust. There's no way to avoid that AFAICT and even if you're an established busine…

> EV no longer skips smartscreen either nowadays.

Not sure of the exact number, but the "nowadays" here is more than a decade.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#78

Post by bahmboo »

ryandrake wrote: post #69
john_strinlai wrote: post #15

for what it is worth, when downloading the latest .exe from github, firefox says "this file is not commonly downloaded" and i have to select "allow download". scans of it are fine. probably just a heuristic-based false-positive, and not a news-worthy story of chrome abusing their monopoly or whatever.

Do these little speed bumps even work? I have to admit I'm so numb to all these popups and to apps warning me this and begging me that, that I just don't read anything anymore. Each app that hits me up with yet another dialog is just another brick in the wall. The only speed bump that I find super annoying is when your browser tries to prevent you from going to a site with an incorrectly configured certificate (or a…

I have been using the internet since before the www. In the last few years I pay attention to every speed bump and evaluate it seriously. I check the url of every financial site I log into. I disable automatic security blocks as a last resort. There's just too much consequence for failure.

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#79

Post by xethos »

nslsm wrote: post #52
ddtaylor wrote: post #41

Earlier quoted context omitted.

Google has been anti yt-dlp before it was forked. They also have rules that carve out tools like this from their extension store and at Android, except enforcement is lacking sometimes. Google is terrified of users having access users control to their video content.

yt-dlp breaks YouTube’s DRM. They could easily get the repo removed under the DMCA. They don’t.

Google's already tried taking down Invidious. If they could use the DMCA for it, I believe they would. Notable, Invidious is still up, and there were fun articles from the response

https://www.vice.com/en/article/youtube-tells-open-source-pr...

Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp

#80

Post by dpoloncsak »

ryandrake wrote: post #69
john_strinlai wrote: post #15

for what it is worth, when downloading the latest .exe from github, firefox says "this file is not commonly downloaded" and i have to select "allow download". scans of it are fine. probably just a heuristic-based false-positive, and not a news-worthy story of chrome abusing their monopoly or whatever.

Do these little speed bumps even work? I have to admit I'm so numb to all these popups and to apps warning me this and begging me that, that I just don't read anything anymore. Each app that hits me up with yet another dialog is just another brick in the wall. The only speed bump that I find super annoying is when your browser tries to prevent you from going to a site with an incorrectly configured certificate (or a…

We recently rolled over an SSL cert that is used for RemoteApps. Most of my users rely on these RemoteApps. They all got the 'yellow warning box' that the SSL cert was different, and we got swamped with tickets.

Atleast in a corporate environment, they help

Post reply on HN