5 ms·

The concrete action they're accusing youtube-dl of is that it "circumvents YouTube’s rolling cipher". The RIAA has used this same complaint to have other sites/

The concrete action they're accusing youtube-dl of is that it "circumvents YouTube’s rolling cipher". The RIAA has used this same complaint to have other sites/tools taken down. I've looked into the implementation, and it turns out the Youtube is at most merely rearranging the characters of the CDN url of the video, and they send you JS code in the page to correctly arrange the characters of the URL so you can download it. Youtube-dl is using the Google-supplied JS and a JS interpreter to transform the Google supplied URL into the URL they need to download the videos. Youtube is asking Google what to do, and Google is saying "here's how you download the video". I explained the full RIAA complaint, with links to prior complaints and the youtube-dl source code, here: https://news.ycombinator.com/item?id=24874111 https://news.ycombinator.com/item?id=24874111

15155 6y ago
Sounds like the next step should be: "embed a JS interpreter and use Google's own code."
- lelandbatey 6y ago
  That is in fact, exactly what youtube-dl is doing. They download the JS code provided by Google, then use regexes to figure out which function is the function that Google provides for un-arranging the characters, then they load Google's JS into an interpreter and provide it with the Google supplied URL to get the original signature. See the code here: https://gitlab.com/HacktorIT/youtube-dl/-/blob/master/youtube_dl/extractor/youtube.py#L1399-1418 https://gitlab.com/HacktorIT/youtube-dl/-/blob/master/youtub... So yeah, Youtube/Google is doing (basically) nothing to protect the content, and for the absolutely token obfuscation they do use, they also provide you with the way to get right back to directly accessing the data without any protections. The RIAA is lying in saying that Google is using technical protections, and they're lying in saying that youtube-dl is doing anything other than what Google tells them to do in order to access videos.
  - 15155 6y ago
    Ah: I assumed this was something a la DeCSS - copyrighted numbers or a decryption algorithm or something. I don't see how this is technically different than implementing any other conforming User Agent. Legally...
    - 0xdeadbeefbabe 6y ago
      Ahem, your honor, please use the gavel to make it official.
  - sjy 6y ago
    Are they lying when they say ‘YouTube’s “rolling cipher” is an effective technical measure within the meaning of EU and German law, which is materially identical to Title 17 U.S.C. §1201 of the United States Code’? That seems quite plausible to me. Executing Google’s code in a regular web browser doesn’t give you a way to save an .mp4 file on your computer.
    - ikeboy 6y ago
      You can use Chrome's Network Tools to download the files. Hard to argue that it's effective when Google's own software can bypass it out of the box. Just check the network tab, copy the URL and remove the range parameter. You'll get one for video and another for audio, which you can merge to recover the original file. This is effectively what youtube-dl does.

15155 6y ago

Sounds like the next step should be: "embed a JS interpreter and use Google's own code."

lelandbatey 6y ago
That is in fact, exactly what youtube-dl is doing. They download the JS code provided by Google, then use regexes to figure out which function is the function that Google provides for un-arranging the characters, then they load Google's JS into an interpreter and provide it with the Google supplied URL to get the original signature. See the code here: https://gitlab.com/HacktorIT/youtube-dl/-/blob/master/youtube_dl/extractor/youtube.py#L1399-1418 https://gitlab.com/HacktorIT/youtube-dl/-/blob/master/youtub... So yeah, Youtube/Google is doing (basically) nothing to protect the content, and for the absolutely token obfuscation they do use, they also provide you with the way to get right back to directly accessing the data without any protections. The RIAA is lying in saying that Google is using technical protections, and they're lying in saying that youtube-dl is doing anything other than what Google tells them to do in order to access videos.
- 15155 6y ago
  Ah: I assumed this was something a la DeCSS - copyrighted numbers or a decryption algorithm or something. I don't see how this is technically different than implementing any other conforming User Agent. Legally...
  - 0xdeadbeefbabe 6y ago
    Ahem, your honor, please use the gavel to make it official.
- sjy 6y ago
  Are they lying when they say ‘YouTube’s “rolling cipher” is an effective technical measure within the meaning of EU and German law, which is materially identical to Title 17 U.S.C. §1201 of the United States Code’? That seems quite plausible to me. Executing Google’s code in a regular web browser doesn’t give you a way to save an .mp4 file on your computer.
  - ikeboy 6y ago
    You can use Chrome's Network Tools to download the files. Hard to argue that it's effective when Google's own software can bypass it out of the box. Just check the network tab, copy the URL and remove the range parameter. You'll get one for video and another for audio, which you can merge to recover the original file. This is effectively what youtube-dl does.