8 ms·

> By now it is clear that the RIAA’s takedown notice backfired badly. With the ‘Streisand Effect’ in full swing, there are now probably more copies of YouTube-D

> By now it is clear that the RIAA’s takedown notice backfired badly. With the ‘Streisand Effect’ in full swing, there are now probably more copies of YouTube-DL online than there ever were. Did it though? Sure, the Streisand effect caused more distribution of youtube-dl, but that's never really been an issue. Open source software as widely used as youtube-dl is mirrored in a hundred different places. The issue here is what does future development of youtube-dl look like? It sounds like the rolling cipher stuff is going to have to go if development is to remain on Github, and that's a win for RIAA.

deleted 6y ago
[deleted]
bleepblorp 6y ago
Github hosting is not the be all and end all of open source software development. There are alternatives, ranging from hosting on one of the Chinese public clouds, using 'bulletproof' hosts that cater to such things as phishing groups, cutting a deal with the Russian mob to host development in Russia, hosting on an .onion site, or making connections with the Pirate Bay folks.
- edgarvaldes 6y ago
  So the alternatives are groups associated with authoritarian regimes, pishing groups and mobs?
  - userbinator 6y ago
    "If you outlaw freedom, only outlaws will have freedom." This isn't all that different from the fact that sites which prominently support free speech attract all the extremists, because that's the only place they have.
    - craftinator 6y ago
      Hah I came to post with that quote in mind. But really, if the legal system is abused to remove tools that are legal but the rich and powerful don't like, they'll migrate to places where the law can't touch them.
  - calvinmorrison 6y ago
    or just literally host a web page yourself with a link to a git repo, also on your server. All this centralization of git is silly
    - rakoo 6y ago
      That's because the whole point of github is not hosting, it's the collaboration. This is where centralization helps.
  - kmeisthax 6y ago
    Git can be cloned via HTTP and it's so easy to set up that people have accidentally done it. There are loads of web shops that accidentally disclosed source code by way of having their Git deploy repo in their Apache webroot. You could literally "git clone http://poorsuckersblog.com/ http://poorsuckersblog.com/" and get everything.
    - Shared404 6y ago
      That domain appears to be unregistered, don't know if anyone is looking for a good domain -- if so, you may have found it.
- hsbauauvhabzb 6y ago
  I would certainly think twice about contributing to YouTube-dl for my legal safety now...
Lammy 6y ago
It’s about awareness, not distribution. How many people learned youtube-dl exists due to news about its takedown?
- deleted 6y ago
  [deleted]
- uponcoffee 6y ago
  Their comment was not about distribution, but on going development. It's easy for an individual site to break youtube-dl, and it happens often. Awareness/distribution don't matter if: A) there is no central repository for updating the project//distributing updates B) threat of legal action deters maintainers from the project
  - ghthor 6y ago
    It's a miracle that OSS ever was developed by large groups of people before github existed. /s
    - dredmorbius 6y ago
      If individual developers are subject to lawsuits and harassment for their contributions, some may choose not to.
ineedasername 6y ago
That depends on the timeframe you consider, and how much push-back there is against this and whether or not the RIAA continues to overreach. If the awareness results in policy changes that preserve something like "archive-preserving tools" then RIAA will have lost the fight against tools that have the potential to infringe.
davidzweig 6y ago
'rolling cipher stuff' - I think you just do a regular web request to a Youtube video page URL (ie https://www.youtube.com/watch?v= https://www.youtube.com/watch?v=...), and the response contains (in a json object) several URLs that point to the video content in various ordinary formats. You don't need to run any JS even, or pull any tricks, just parse the response string and fish out the URLs. 'rolling cipher' means the URLs change (over time, user?), so they aren't useful for sharing to others. What is the 'technical circumvention' here?
- grishka 6y ago
  As I already said in another thread several days ago, not quite. For most videos, yes, you do a request to https://www.youtube.com/get_video_info?video_id= https://www.youtube.com/get_video_info?video_id=... and there are links to files and adaptive streaming playlists. But then there's stuff like VEVO music videos, and those have an additional layer of protection in the form of some signature IIRC that you need to add to those stream URLs to make them valid. Source: I added a custom YouTube player to my app several years ago, and, actually, besides my own reverse engineering, youdube-dl sources were quite helpful with figuring it all out. It didn't play those "protected" videos though.
- hombre_fatal 6y ago
  Looks like there's more to it. https://gitlab.com/ytdl-org/youtube-dl/-/blob/master/youtube_dl/extractor/youtube.py https://gitlab.com/ytdl-org/youtube-dl/-/blob/master/youtube... When I think of what it's like being an engineer (regardless of field), I think of the distance between "isn't the solution as simple as...?" and what the project actually looks like after a year in production after encountering the full domain of things that can go wrong. Though youtube-dl also simply does more than what you're assuming. And ctrl-f for "drm".
  - keeganpoppen 6y ago
    the mentions of drm in that code seem completely trivial to me
1vuio0pswjnm7 6y ago
IME, most YouTube videos do not use any technological measure to prevent using any TCP client, not simply Google's Javascript player compbined with a web browser, to download the video. Moreover I have observed that for most YT videos Google's player uses "progressive download", i.e., a number of successive HTTP requests with incremented Range headers, not "streaming". Thus, for most videos, there is no need to circumvent any technological measure, e.g., a so-called "rolling cipher" for the video signature. Section 1201, specifically referenced in RIAA's letter, requires that the circumvention software be "primarily" designed for circumvention. It's arguable youtube-dl is not primarily designed for downloading the minority of YT videos that use the rolling cipher, or whatever "protection" Google may choose to offer the minority of YT accounts that want to use YT as a distribution channel for commercial content, e.g., VEVO. With the rolling cipher, Google tries to ensure all HTTP requests sent by the user are made via its own Javascript player. However this still does not stop anyone using a popular browser with Developer Tools or the equivalent (such as Microsoft's own Edge browser) from obtaining the download URL and using any TCP client the user chooses to perform the download. Nor does it stop any user from observing the download URL via other means, e.g., users observing the TCP traffic entering their personal networks. Through the use of the rolling cipher, YT does not restrict access to the the download URL. It simply changes the URL periodically. The rolling cipher is thus not an effective access control. For example, when Google promises YT account holders Google can prevent users in a certain geographic region from accessing a video, does Google use a rolling cipher in the Javascript player as the access control.
- curryst 6y ago
  > Section 1201, specifically referenced in RIAA's letter, requires that the circumvention software be "primarily" designed for circumvention. It's arguable youtube-dl is not primarily designed for downloading the minority of YT videos that use the rolling cipher, or whatever "protection" Google may choose to offer the minority of YT accounts that want to use YT as a distribution channel for commercial content, e.g., VEVO. I still think it's debatable whether youtube-dl constitutes circumvention of effective controls or not. This is the relevant definition: > a technological measure “effectively controls access to a work” if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work. I'm not intimately familiar, but is youtube-dl cracking the rolling cipher, or using the keys that YouTube provides? I believe there is a very valid argument that using youtube-dl is not evidence of circumvention of effective access control systems. There are a plethora of other reasons one might want to use it. One perfectly legitimate example is if you want to watch a video in 1080p without constant buffering, but you aren't on a network connection that can support that. You're basically using your hard drive as a much, much larger buffer. You can often even play the videos with the same browser that opened YouTube, so it really does become effectively cached content (albeit a cache external to your browser). I think they would also have to demonstrate that downloading one of those videos is a copyright violation. You could argue that as long as the video is available, it should be valid for you to cache those videos. If I'm going on a plane, or I know my internet is going to be out, is it really a DMCA violation for me to download those videos and time shift my viewing to when my internet is out? > Through the use of the rolling cipher, YT does not restrict access to the the download URL. It simply changes the URL periodically. The rolling cipher is thus not an effective access control. For example, when Google promises YT account holders Google can prevent users in a certain geographic region from accessing a video, does Google use a rolling cipher in the Javascript player as the access control. I disagree with this part. As much as I don't like it, I can't find any way that the rolling cipher is not "effective access control". I linked the definition above, but to the layman (and these laws were written by laymen, so you do have to bear in mind their intent) periodically changing the download URL is an effective access control because they can't bookmark it and go back to it later. We can argue that using the Developer Tools is "in the normal course of operation", but I think you're extremely unlikely to get a judge to agree that opening the Developer Tools is "in the normal course of operation". It's normal to us, but it is not normal for the US as a whole. In short, I think anything that you can't bookmark a download for probably counts as "effectively controls access". I'm sure other industries feel the same way; oil execs say what they're doing is slightly different than what the law stipulates, doctors says what they did doesn't exactly match up with what malpractice law requires, etc. The only person who's opinion matters is the judge, and they probably aren't an expert. As an overall summary, I think we're more likely to succeed by poking holes in the RIAA's case. Youtube-DL is under no legal obligation to prove anything; the RIAA as the plaintiff is responsible for proving all of the facts they assert. As long as we try to combat that with our own assertions, they can simply try to poke holes in those. It seems much more difficult to prove that youtube-dl's usage is legitimate than it is to poke holes in one of the assumptions underlying the RIAA's lawsuit. If this is legitimate use, youtube-dl wins. If this is not circumvention, but an alternate access mechanism, youtube-dl wins. If you can prove that rolling ciphers are not an effective control measure, youtube-dl wins. I think the most likely of those options is demonstrating that youtube-dl is fair use (I wonder if there are any accessibility reasons to use youtube-dl; that would hamstring the RIAA, as they'd be caught between the ADA and the DMCA. They either have a valid DMCA complaint but YouTube is liable under DMCA, or they don't have a valid complaint because youtube-dl is required to meet ADA specifications). I don't even have to think very hard to come up with a few non-infringing reasons why someone would use youtube-dl. The RIAA then has to prove that youtube-dl is "primarily designed ... for the purpose of circumventing a technological measure", rather than for the variety of non-infringing reasons one might use youtube-dl.
pgt 6y ago
It annoyed me enough to put me back into a buying position. I looked at Gitlab pricing after paying Github every month for a long time (hey, Business Guy: we'll switch in a heartbeat) and I started thinking about what it would take to host code in a decentralized fashion. In a free market it is important that when you are displeased with a supplier that you truthfully tell that supplier why you are displeased (ideally very vocally) and are actively considering alternatives. It is one of the few early-warning signals that might change their behaviour. But ideally, just stop giving them money immediately and tell them, but mention that you are willing to change your mind if they change their behaviour. And if they vascillate too often between what is right and what is profitable, inform the entire system even if it is a great personal expense. As long as it benefits the system, you will come out okay in the end.
- JamesLeonis 6y ago
  > I started thinking about what it would take to host code in a decentralized fashion. May I introduce you to GitTorrent? https://github.com/cjb/GitTorrent https://github.com/cjb/GitTorrent
  - justinclift 6y ago
    Last updated 5 years ago, with no obvious successor. :/
    - yepguy 6y ago
      https://github.com/dhappy/git-remote-ipfs https://github.com/dhappy/git-remote-ipfs Also relevant if you go the p2p route: https://github.com/MichaelMure/git-bug https://github.com/MichaelMure/git-bug
- ralph84 6y ago
  GitLab's DMCA policy is not substantially different from GitHub's. Finding an example of YouTube-dl on GitLab doesn't mean GitLab doesn't comply with the DMCA, it just means RIAA hasn't sent them a DMCA notice yet. Regardless of how vocal you are you won't convince a company with US operations to not comply with the DMCA. Rather than getting mad at companies for complying with the law of the country they operate in, why not support organizations like EFF that are actively working to change the DMCA? https://www.eff.org/issues/dmca https://www.eff.org/issues/dmca
vinniejames 6y ago
Why would the RIAA have any right to demand the rolling cipher be removed?

deleted 6y ago

[deleted]

bleepblorp 6y ago

Github hosting is not the be all and end all of open source software development. There are alternatives, ranging from hosting on one of the Chinese public clouds, using 'bulletproof' hosts that cater to such things as phishing groups, cutting a deal with the Russian mob to host development in Russia, hosting on an .onion site, or making connections with the Pirate Bay folks.

edgarvaldes 6y ago
So the alternatives are groups associated with authoritarian regimes, pishing groups and mobs?
- userbinator 6y ago
  "If you outlaw freedom, only outlaws will have freedom." This isn't all that different from the fact that sites which prominently support free speech attract all the extremists, because that's the only place they have.
  - craftinator 6y ago
    Hah I came to post with that quote in mind. But really, if the legal system is abused to remove tools that are legal but the rich and powerful don't like, they'll migrate to places where the law can't touch them.
- calvinmorrison 6y ago
  or just literally host a web page yourself with a link to a git repo, also on your server. All this centralization of git is silly
  - rakoo 6y ago
    That's because the whole point of github is not hosting, it's the collaboration. This is where centralization helps.
- kmeisthax 6y ago
  Git can be cloned via HTTP and it's so easy to set up that people have accidentally done it. There are loads of web shops that accidentally disclosed source code by way of having their Git deploy repo in their Apache webroot. You could literally "git clone http://poorsuckersblog.com/ http://poorsuckersblog.com/" and get everything.
  - Shared404 6y ago
    That domain appears to be unregistered, don't know if anyone is looking for a good domain -- if so, you may have found it.
hsbauauvhabzb 6y ago
I would certainly think twice about contributing to YouTube-dl for my legal safety now...

Lammy 6y ago

It’s about awareness, not distribution. How many people learned youtube-dl exists due to news about its takedown?

deleted 6y ago
[deleted]
uponcoffee 6y ago
Their comment was not about distribution, but on going development. It's easy for an individual site to break youtube-dl, and it happens often. Awareness/distribution don't matter if: A) there is no central repository for updating the project//distributing updates B) threat of legal action deters maintainers from the project
- ghthor 6y ago
  It's a miracle that OSS ever was developed by large groups of people before github existed. /s
  - dredmorbius 6y ago
    If individual developers are subject to lawsuits and harassment for their contributions, some may choose not to.

ineedasername 6y ago

That depends on the timeframe you consider, and how much push-back there is against this and whether or not the RIAA continues to overreach. If the awareness results in policy changes that preserve something like "archive-preserving tools" then RIAA will have lost the fight against tools that have the potential to infringe.

davidzweig 6y ago

'rolling cipher stuff' - I think you just do a regular web request to a Youtube video page URL (ie https://www.youtube.com/watch?v= https://www.youtube.com/watch?v=...), and the response contains (in a json object) several URLs that point to the video content in various ordinary formats. You don't need to run any JS even, or pull any tricks, just parse the response string and fish out the URLs. 'rolling cipher' means the URLs change (over time, user?), so they aren't useful for sharing to others. What is the 'technical circumvention' here?

grishka 6y ago
As I already said in another thread several days ago, not quite. For most videos, yes, you do a request to https://www.youtube.com/get_video_info?video_id= https://www.youtube.com/get_video_info?video_id=... and there are links to files and adaptive streaming playlists. But then there's stuff like VEVO music videos, and those have an additional layer of protection in the form of some signature IIRC that you need to add to those stream URLs to make them valid. Source: I added a custom YouTube player to my app several years ago, and, actually, besides my own reverse engineering, youdube-dl sources were quite helpful with figuring it all out. It didn't play those "protected" videos though.
hombre_fatal 6y ago
Looks like there's more to it. https://gitlab.com/ytdl-org/youtube-dl/-/blob/master/youtube_dl/extractor/youtube.py https://gitlab.com/ytdl-org/youtube-dl/-/blob/master/youtube... When I think of what it's like being an engineer (regardless of field), I think of the distance between "isn't the solution as simple as...?" and what the project actually looks like after a year in production after encountering the full domain of things that can go wrong. Though youtube-dl also simply does more than what you're assuming. And ctrl-f for "drm".
- keeganpoppen 6y ago
  the mentions of drm in that code seem completely trivial to me

1vuio0pswjnm7 6y ago

IME, most YouTube videos do not use any technological measure to prevent using any TCP client, not simply Google's Javascript player compbined with a web browser, to download the video. Moreover I have observed that for most YT videos Google's player uses "progressive download", i.e., a number of successive HTTP requests with incremented Range headers, not "streaming". Thus, for most videos, there is no need to circumvent any technological measure, e.g., a so-called "rolling cipher" for the video signature. Section 1201, specifically referenced in RIAA's letter, requires that the circumvention software be "primarily" designed for circumvention. It's arguable youtube-dl is not primarily designed for downloading the minority of YT videos that use the rolling cipher, or whatever "protection" Google may choose to offer the minority of YT accounts that want to use YT as a distribution channel for commercial content, e.g., VEVO. With the rolling cipher, Google tries to ensure all HTTP requests sent by the user are made via its own Javascript player. However this still does not stop anyone using a popular browser with Developer Tools or the equivalent (such as Microsoft's own Edge browser) from obtaining the download URL and using any TCP client the user chooses to perform the download. Nor does it stop any user from observing the download URL via other means, e.g., users observing the TCP traffic entering their personal networks. Through the use of the rolling cipher, YT does not restrict access to the the download URL. It simply changes the URL periodically. The rolling cipher is thus not an effective access control. For example, when Google promises YT account holders Google can prevent users in a certain geographic region from accessing a video, does Google use a rolling cipher in the Javascript player as the access control.

curryst 6y ago
> Section 1201, specifically referenced in RIAA's letter, requires that the circumvention software be "primarily" designed for circumvention. It's arguable youtube-dl is not primarily designed for downloading the minority of YT videos that use the rolling cipher, or whatever "protection" Google may choose to offer the minority of YT accounts that want to use YT as a distribution channel for commercial content, e.g., VEVO. I still think it's debatable whether youtube-dl constitutes circumvention of effective controls or not. This is the relevant definition: > a technological measure “effectively controls access to a work” if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work. I'm not intimately familiar, but is youtube-dl cracking the rolling cipher, or using the keys that YouTube provides? I believe there is a very valid argument that using youtube-dl is not evidence of circumvention of effective access control systems. There are a plethora of other reasons one might want to use it. One perfectly legitimate example is if you want to watch a video in 1080p without constant buffering, but you aren't on a network connection that can support that. You're basically using your hard drive as a much, much larger buffer. You can often even play the videos with the same browser that opened YouTube, so it really does become effectively cached content (albeit a cache external to your browser). I think they would also have to demonstrate that downloading one of those videos is a copyright violation. You could argue that as long as the video is available, it should be valid for you to cache those videos. If I'm going on a plane, or I know my internet is going to be out, is it really a DMCA violation for me to download those videos and time shift my viewing to when my internet is out? > Through the use of the rolling cipher, YT does not restrict access to the the download URL. It simply changes the URL periodically. The rolling cipher is thus not an effective access control. For example, when Google promises YT account holders Google can prevent users in a certain geographic region from accessing a video, does Google use a rolling cipher in the Javascript player as the access control. I disagree with this part. As much as I don't like it, I can't find any way that the rolling cipher is not "effective access control". I linked the definition above, but to the layman (and these laws were written by laymen, so you do have to bear in mind their intent) periodically changing the download URL is an effective access control because they can't bookmark it and go back to it later. We can argue that using the Developer Tools is "in the normal course of operation", but I think you're extremely unlikely to get a judge to agree that opening the Developer Tools is "in the normal course of operation". It's normal to us, but it is not normal for the US as a whole. In short, I think anything that you can't bookmark a download for probably counts as "effectively controls access". I'm sure other industries feel the same way; oil execs say what they're doing is slightly different than what the law stipulates, doctors says what they did doesn't exactly match up with what malpractice law requires, etc. The only person who's opinion matters is the judge, and they probably aren't an expert. As an overall summary, I think we're more likely to succeed by poking holes in the RIAA's case. Youtube-DL is under no legal obligation to prove anything; the RIAA as the plaintiff is responsible for proving all of the facts they assert. As long as we try to combat that with our own assertions, they can simply try to poke holes in those. It seems much more difficult to prove that youtube-dl's usage is legitimate than it is to poke holes in one of the assumptions underlying the RIAA's lawsuit. If this is legitimate use, youtube-dl wins. If this is not circumvention, but an alternate access mechanism, youtube-dl wins. If you can prove that rolling ciphers are not an effective control measure, youtube-dl wins. I think the most likely of those options is demonstrating that youtube-dl is fair use (I wonder if there are any accessibility reasons to use youtube-dl; that would hamstring the RIAA, as they'd be caught between the ADA and the DMCA. They either have a valid DMCA complaint but YouTube is liable under DMCA, or they don't have a valid complaint because youtube-dl is required to meet ADA specifications). I don't even have to think very hard to come up with a few non-infringing reasons why someone would use youtube-dl. The RIAA then has to prove that youtube-dl is "primarily designed ... for the purpose of circumventing a technological measure", rather than for the variety of non-infringing reasons one might use youtube-dl.

pgt 6y ago

It annoyed me enough to put me back into a buying position. I looked at Gitlab pricing after paying Github every month for a long time (hey, Business Guy: we'll switch in a heartbeat) and I started thinking about what it would take to host code in a decentralized fashion. In a free market it is important that when you are displeased with a supplier that you truthfully tell that supplier why you are displeased (ideally very vocally) and are actively considering alternatives. It is one of the few early-warning signals that might change their behaviour. But ideally, just stop giving them money immediately and tell them, but mention that you are willing to change your mind if they change their behaviour. And if they vascillate too often between what is right and what is profitable, inform the entire system even if it is a great personal expense. As long as it benefits the system, you will come out okay in the end.

JamesLeonis 6y ago
> I started thinking about what it would take to host code in a decentralized fashion. May I introduce you to GitTorrent? https://github.com/cjb/GitTorrent https://github.com/cjb/GitTorrent
- justinclift 6y ago
  Last updated 5 years ago, with no obvious successor. :/
  - yepguy 6y ago
    https://github.com/dhappy/git-remote-ipfs https://github.com/dhappy/git-remote-ipfs Also relevant if you go the p2p route: https://github.com/MichaelMure/git-bug https://github.com/MichaelMure/git-bug
ralph84 6y ago
GitLab's DMCA policy is not substantially different from GitHub's. Finding an example of YouTube-dl on GitLab doesn't mean GitLab doesn't comply with the DMCA, it just means RIAA hasn't sent them a DMCA notice yet. Regardless of how vocal you are you won't convince a company with US operations to not comply with the DMCA. Rather than getting mad at companies for complying with the law of the country they operate in, why not support organizations like EFF that are actively working to change the DMCA? https://www.eff.org/issues/dmca https://www.eff.org/issues/dmca

vinniejames 6y ago

Why would the RIAA have any right to demand the rolling cipher be removed?