Hacker News Reader

Comment by mox1 | Hacker News Reader

The rebuttal to your reasoning is in the letter. Basically a federal judge has previously ruled that utilizing a publicly available password is not circumvention of a copyright protection mechanism. The code containing the "sig" (as google calls it) or "rolling cipher" (as RIAA calls it) is available to anyone by viewing the JavaScript. This sig / cipher being public means it is not a copyright protection mechanism.

View on HN

The detail of the “publicly available password” case [1] is quite interesting. It’s not directly analogous to the YouTube system, but as the EFF points out, the RIAA’s reliance on German law has its own problems.

> When Petrolink learned that one of its largest customers, EOG Resources, might switch over to Digidrill’s visualization service, Petrolink took action. Instead of paying Digidrill for access to the corrected drilling data via LiveLog, Petrolink obtained a laptop running DataLogger – along with the corresponding USB security dongle – and then, after realizing DataLogger used an open source Firebird database, managed to gain access to the database by using Firebird's default administrator username and password. Armed with this access, Petrolink developed a program named “RIG WITSML” (dubbed “the scraper” or “the hack”) that could be installed on an MWD company’s computer running DataLogger in order to – in real time – query corrected drilling data from the DataLogger database and transfer that information to PetroVault for visualization. Petrolink then began installing this RIG WITSML program on MWD computers running DataLogger at more than 300 well sites.

[1] https://www.courtlistener.com/opinion/4765801/digital-drilli...

> This sig / cipher being public means it is not a copyright protection mechanism.

I can see this as ending up with Youtube being forced to require sign-ins. Massive expense for Google. Then Youtube-dl adds one parameter for the password, and we're back to square one.

You already have to sign in to view some videos, don’t you? Does YT-dL not have a way to handle those right now?

Do you? I've never tried to watch any that have required it.

Maybe there's Red-only content that isn't advertised/recommended to non-subscribers?

Content with a certain age threshold triggers login. The last time I looked at this, embedding these videos was still possible without logging in. So there are definitely ways in accessing the content without authentication.

Hm. If embedding works maybe my ad-blocking is sufficient; or I just haven't come across any that require it. I mostly just watch woodworkers/machinists/electronics/etc. Sort of conceivable it could be age restricted but would also be surprising.

There's also members-only content on some channels that requires a paid subscription to access.

It does, but it's broken.

https://github.com/ytdl-org/youtube-dl/issues/23860

The developers are not responding to the issue, and from what I understand it is borderline impossible to fix, because there is an entire security team behind the Google login protection. The only workaround is to login with a browser and copy the cookies from it to youtube-dl.

> The only workaround is to login with a browser and copy the cookies from it to youtube-dl.

That's really easy to do with postman.

>postman

It just works. Every time. It’s gotta be one of the most unappreciated tools out there right now.

"Postman" seems like a pretty generic name.

Looking quickly online, maybe you're meaning this one?

https://www.postman.com

I'm pretty sure that is what they mean, yes. It is a nice tool. Lets you write HTTP(S) templates with parameters and whatnot, save them in groups, send them, handle the response, etc.

Funny. I initially read that as “The Postman” - kind of like “The Batman.”

And your response is regarding whether it should be referred to in the definite article.

Why not simply create a youtube-login command that does nothing but launch an electron instance that lets you login into youtube and then returns the cookie?

youtube-dl could then call that command to obtain the cookie.

There’s a good chance that behavior would result in a CAPTCHA.

The idea, I think, is that it literally launches a browser to let a human do the whole thing.

You can automate fetching Chrome’s cookies. This is generally very useful for scraping.

https://github.com/blackjack4494/yt-dlc is maintained by someone who responds to issues.

Youtube wasn't behind the DMCA takedown, though. Do they even care about youtube-dl?

Google quickly kills any iOS/Android app that offers offline playback functionality for YouTube, so I can't imagine they love youtube-dl. They probably only haven't made a stink because it might attract more attention to a tool primarily only known about in techhead circles.

I think the difference is that offline playback and background playback on iOS/Android can be unlocked through YouTube Premium so those apps directly interfere with YouTube's bottom line. YouTube-dl I don't really see as directly competing with that because it's not trivial to download a YouTube video from it to your phone.

You can use Firefox mobile and the "Video Background Play Fix" addon to disable the browser APIs that allow the background play blocking antifeature.

Alternatively, the NewPipe app available on F-Droid can be used to both play videos in the background and download them.

And given how unlikely people are in the wider non-technical audience to god-forbid, run a command line program, I guess they really just don't care.

They do take easily accessible apps that use youtube-dl under the hood pretty seriously. I guess it depends on how much of an effort it is for them vs how much of their bottom line ytdl is cutting into.

> Do they [YouTube/Google] even care about youtube-dl?

A downloaded video doesn't generate ad revenue.

Yes, but is there any indication that they work against youtube-dl in some specific way? Adversarial actions like changing youtube to render youtube-dl non-functional?

Downloaded videos often get remixed into other videos that generate ad revenue. Commentary, reaction videos and compilations are substantial parts of youtube.

i often watch youtube videos from mpv exactly to get away from those distractions.

Yes it does. I go to the page (ad), copy the URL, and youtube-dl.

More critically, Youtube relies on network effects and people using it. Part of the reason we share family videos, educational content, and other things is so it's, well, shared. For me, the reasons to use Youtube-dl are:

1) People in bandwidth-constrained settings. If I post my videos, and colleagues in some countries can't watch them, I'm going elsewhere.

2) Remixing. If I can't make collages of family videos, I'm going elsewhere.

Youtube can serve masters like me, where it's an effective platform for sharing videos I want people to watch, and where the goal is dissemination. It can serve masters like the RIAA and the MPAA, where the goal is monetization and control. It will have a hard time serving both.

I suspect if it tries, people like me will go to someone who caters to us. A YouYesYouNoNotTheRIAAYesYOUTube. If we do, I think there will be enough of a network to start to syphon people off, and eventually, cat videos and Aunt Alice will be on YYYNNTRYYT.com, while corporate video will be on DRMed Youtube.

At that point, we'll have a replay.

>I go to the page (ad), copy the URL, and youtube-dl.

Youtube-dl has an integrated search function, so you actually don't have to open the video in a browser at all.

That's secondary to the rest of your comment, but I thought it was worth noting.

Perhaps more importantly, the number of people using youtube-dl because it allows you to watch videos without ads almost certainly pales in comparison to the number of people just using adblockers. Youtube-dl makes you wait.

there is no waiting when youtube-dl is used from mpv or similar.

How many people downloaded Shake It Off with youtube-dl vs. the people who watched it from the official YouTube app or stock Google Chrome? youtube-dl does not nearly threaten their revenue in any tangible way.

Youtube has to listen to the RIAA's demands because music and music videos are a huge portion of their traffic. The music industry could decide to move all that to Spotify if they chose.

Yea ha ha.

They took that poison pill already, I really, really doubt they ever new pop music stops being part of youtube in the future, the audience is too large. It would be like them taking music off of the radio because people could record it on reel-to-reels. They might stomp around a bit and try to use the law to get what they want, but when push comes to shove the big labels will keep their music on youtube.

The RIAA/NARM/etc. needs YouTube WAY more than vice-versa.

No they cannot. Music videos that aren't on Youtube don't generate much in the way of traffic anywhere else. Artists have tried it and failed.

They absolutely need eachother and can't afford to be nasty to eachother.

Or they just start to use Wildvine protection for their videos

It's already there, you can authenticate using a cookie file if you want.

I am not that afraid that google would require sign-ins for everything. Even google with its massive market dominance should be pretty scared of given such a clear opening for a competitor, and being accessible without a login is a huge feature in order to get market share quickly compared to a competitor that does not.

Not to mention, all that ad revenue.

People will literally just give up and straight up do something else if content is behind a auth-wall.

i am already getting a "please log in" nag screen almost every time i open a video link (i block all cookies from youtube).

What is considered publicly available?

I suppose right clicking and selecting view source is ok, but reverse engineering a code out of a hardware chip isn't?

Because any kind of DRM basically has a key in the possession of the user. There are just different levels of difficulty to read that key.

Reply on news.ycombinator.com