5 ms·

> RIAA is alleging that youtube-dl is a copy protection circumvention tool How is it circumventing copy protection? IIRC videos on Youtube aren't DRMed. What p

by Aaargh20318 3y ago

> RIAA is alleging that youtube-dl is a copy protection circumvention tool How is it circumventing copy protection? IIRC videos on Youtube aren't DRMed. What protection method do they claim is being circumvented exactly?

cookiengineer 3y ago
Youtube is using base64 "encryption" * and the reason the court decided in favor of youtube in the youtube-dl case was exactly this reason. The court thinks that base64 is a legitimate way to establish copyright protection online. Yeah, not kidding you. The lawyers are this stupid. Honestly I think the law is broken, because it is designed by people not capable of doing technological decisions, for technologically relevant cases. It is gonna take years to unfuck this. * duh, they don't even know differences of encoding vs encryption...
- kQq9oHeAz6wLLS 3y ago
  They must have the same lawyers and be getting the same judges as anti-2A groups. The level of misinformation and lack of understanding about the topic in contention feels similar.
- Aaargh20318 3y ago
  They base64 encode the video files? Why? That doesn’t do anything except increase the bandwidth needed.
  - cookiengineer 3y ago
    It's not the video files but the m3u playlist iirc that is base64 encoded and contains the urls+tokens for all the chunks of the videostream
- dataflow 3y ago
  > Youtube is using base64 "encryption" * and the reason the court decided in favor of youtube in the youtube-dl case was exactly this reason. [...] The lawyers are this stupid. The law has other things listed beside encryption. Did they really call this "encryption" as you're claiming (citation?) or did it fall under another bucket?
  - cookiengineer 3y ago
    They were referring to it as a "Rolling Cipher" (searchable) and reinforcing the claim based on Widevine as a protection mechanism for the (previously hosted) Youtube Red content. [1] They were making the case "if youtube decided to replace the rolling cipher with widevine completely, it would seriously harden the DRM protection". "Die Einordnung der "Rolling Cipher" als wirksame technische Schutzmaßnahme ist auch unter Berücksichtigung der Regelung des § 53 Abs. 1 UrhG zur Zulässigkeit von Vervielfältigungen zum privaten Gebrauch verhältnismäßig." This translates to that they think base64 is a reasonable technical measurement to protect content. By this logic they've established that URLs themselves are a valid copyright protection mechanism (encodeURIComponent uses base64url behind the scenes), which has another scale of consequences. That is why I'd argue that the court has no idea whatsoever what base64 is, what it does, or that it is even an openly defined specification as a text interchange format. I think what confused the court is the parameter shuffling for the signature parameter in combination with base64. Even though this is not encryption they made it look like effective encryption in front of the court. [1] https://openjur.de/u/2466945.html https://openjur.de/u/2466945.html
- schrodinger 3y ago
  I feel like it doesn’t make a difference how good the “encryption” is, it displays intent that you wouldn’t like your data downloaded. Just like an open door to your house vs a really easy to pick locked door makes a big difference.
  - userbinator 3y ago
    IMHO it displays intent to require a browser that has JS, which yt-dl has sort of implemented.
    - jonhohle 3y ago
      Base64 doesn’t require JS, it requires a Base64 decoder, which either every language has, or any CS student who’s taken an algorithms class could write in a few hours for the language of their choice. Base64 encoding/decoding is the type of thing you could ask most applicants to write during an interview. It’s like saying they encrypted it in UTF-8.
      - userbinator 3y ago
        Base64 is just one of the components of the JS that YouTube uses to generate the actual video URLs. It's been at least a few months since I took a look at it, but I remember it having a substitution cipher and some other transformations, but no "real" crypto like AES and such. That said, if they're effectively giving you both the lock and the key, is it really circumvention of access control to unlock it with anything other than a user-agent they "support" (i.e. approve of)? As I mentioned in my other comment here (https://news.ycombinator.com/item?id=37114697 https://news.ycombinator.com/item?id=37114697), a lot of people "download" from YouTube not to infringe copyright but to simply use alternative software to view the content.
        mcpackieh 3y ago
        > they're effectively giving you both the lock and the key, DRM in a nutshell. I think we have to assume the anti-circumvention laws are intended to apply in precisely this kind of circumstance, since that describes virtually all DRM. When these laws were written, it was even common for DRM to be implemented as XORing with some single byte "key", which was trivial to either extract from the program or just brute force.
- mcpackieh 3y ago
  > the court decided in favor of youtube This didn't happen AFAIK; the action against Youtube-dl is being taken by the RIAA, not Youtube/Google.
- rocqua 3y ago
  It's not just base-64. The 'url' of the next chunk of data is encoded in the data of the previous chunk. (As opposed to just doing a chunked transfer of a bigger file). This feature is only in place for some videos, mostly music videos. This was deemed a 'rolling cipher'. It obviously isn't. Or at best, its a rolling cipher with the key being completely public at all times.
  - Qwertious 3y ago
    Does this mean a linked list counts as DRM?
  - Aaargh20318 3y ago
    As a non-lawyer I would assume that a simple testimony by an expert witness (i.e. a crypto expert) would easily squash this argument.
- dspillett 3y ago
  > The court thinks that base64 is a legitimate way to establish copyright protection online. > Yeah, not kidding you. The lawyers are this stupid. The system is this stupid. The lawyers are fairly clever to pull off this sort of stuff regularly. You have to be intelligent to be actively evil.
ForHackernews 3y ago
> videos on Youtube aren't DRMed They are: https://developers.google.com/widevine/drm/overview https://developers.google.com/widevine/drm/overview
- sodality2 3y ago
  Only for paid products (movies, TV shows, etc). Regular videos (even music videos) do not use WideVine DRM or else no tool would be able to download YouTube videos. (Or at least, public tool - private scene groups do of course have bypasses for it)
Brian_K_White 3y ago
Where is the button on any official YouTube app or web interface that offers to save a local unencrypted file for an anonymous user?
- whycome 3y ago
  I guess the right click button that allows me to “save link as” is circumventing a websites lack of a “download this image” button?
  - Brian_K_White 3y ago
    Yes. Especially when the site uses indirection and js specifically to obstruct it. It doesn't matter that it's not possible to really prevent it, they can demonstrate that they definitely intended to. Locking something with a trivial lock, but still clearly a lock with no other intended purpose but to be a lock, is entirely different from not trying to lock something, when it comes to going to court to claim that someone stole something.

cookiengineer 3y ago

Youtube is using base64 "encryption" * and the reason the court decided in favor of youtube in the youtube-dl case was exactly this reason. The court thinks that base64 is a legitimate way to establish copyright protection online. Yeah, not kidding you. The lawyers are this stupid. Honestly I think the law is broken, because it is designed by people not capable of doing technological decisions, for technologically relevant cases. It is gonna take years to unfuck this. * duh, they don't even know differences of encoding vs encryption...

kQq9oHeAz6wLLS 3y ago
They must have the same lawyers and be getting the same judges as anti-2A groups. The level of misinformation and lack of understanding about the topic in contention feels similar.
Aaargh20318 3y ago
They base64 encode the video files? Why? That doesn’t do anything except increase the bandwidth needed.
- cookiengineer 3y ago
  It's not the video files but the m3u playlist iirc that is base64 encoded and contains the urls+tokens for all the chunks of the videostream
dataflow 3y ago
> Youtube is using base64 "encryption" * and the reason the court decided in favor of youtube in the youtube-dl case was exactly this reason. [...] The lawyers are this stupid. The law has other things listed beside encryption. Did they really call this "encryption" as you're claiming (citation?) or did it fall under another bucket?
- cookiengineer 3y ago
  They were referring to it as a "Rolling Cipher" (searchable) and reinforcing the claim based on Widevine as a protection mechanism for the (previously hosted) Youtube Red content. [1] They were making the case "if youtube decided to replace the rolling cipher with widevine completely, it would seriously harden the DRM protection". "Die Einordnung der "Rolling Cipher" als wirksame technische Schutzmaßnahme ist auch unter Berücksichtigung der Regelung des § 53 Abs. 1 UrhG zur Zulässigkeit von Vervielfältigungen zum privaten Gebrauch verhältnismäßig." This translates to that they think base64 is a reasonable technical measurement to protect content. By this logic they've established that URLs themselves are a valid copyright protection mechanism (encodeURIComponent uses base64url behind the scenes), which has another scale of consequences. That is why I'd argue that the court has no idea whatsoever what base64 is, what it does, or that it is even an openly defined specification as a text interchange format. I think what confused the court is the parameter shuffling for the signature parameter in combination with base64. Even though this is not encryption they made it look like effective encryption in front of the court. [1] https://openjur.de/u/2466945.html https://openjur.de/u/2466945.html
schrodinger 3y ago
I feel like it doesn’t make a difference how good the “encryption” is, it displays intent that you wouldn’t like your data downloaded. Just like an open door to your house vs a really easy to pick locked door makes a big difference.
- userbinator 3y ago
  IMHO it displays intent to require a browser that has JS, which yt-dl has sort of implemented.
  - jonhohle 3y ago
    Base64 doesn’t require JS, it requires a Base64 decoder, which either every language has, or any CS student who’s taken an algorithms class could write in a few hours for the language of their choice. Base64 encoding/decoding is the type of thing you could ask most applicants to write during an interview. It’s like saying they encrypted it in UTF-8.
    - userbinator 3y ago
      Base64 is just one of the components of the JS that YouTube uses to generate the actual video URLs. It's been at least a few months since I took a look at it, but I remember it having a substitution cipher and some other transformations, but no "real" crypto like AES and such. That said, if they're effectively giving you both the lock and the key, is it really circumvention of access control to unlock it with anything other than a user-agent they "support" (i.e. approve of)? As I mentioned in my other comment here (https://news.ycombinator.com/item?id=37114697 https://news.ycombinator.com/item?id=37114697), a lot of people "download" from YouTube not to infringe copyright but to simply use alternative software to view the content.
      - mcpackieh 3y ago
        > they're effectively giving you both the lock and the key, DRM in a nutshell. I think we have to assume the anti-circumvention laws are intended to apply in precisely this kind of circumstance, since that describes virtually all DRM. When these laws were written, it was even common for DRM to be implemented as XORing with some single byte "key", which was trivial to either extract from the program or just brute force.
mcpackieh 3y ago
> the court decided in favor of youtube This didn't happen AFAIK; the action against Youtube-dl is being taken by the RIAA, not Youtube/Google.
rocqua 3y ago
It's not just base-64. The 'url' of the next chunk of data is encoded in the data of the previous chunk. (As opposed to just doing a chunked transfer of a bigger file). This feature is only in place for some videos, mostly music videos. This was deemed a 'rolling cipher'. It obviously isn't. Or at best, its a rolling cipher with the key being completely public at all times.
- Qwertious 3y ago
  Does this mean a linked list counts as DRM?
- Aaargh20318 3y ago
  As a non-lawyer I would assume that a simple testimony by an expert witness (i.e. a crypto expert) would easily squash this argument.
dspillett 3y ago
> The court thinks that base64 is a legitimate way to establish copyright protection online. > Yeah, not kidding you. The lawyers are this stupid. The system is this stupid. The lawyers are fairly clever to pull off this sort of stuff regularly. You have to be intelligent to be actively evil.

ForHackernews 3y ago

> videos on Youtube aren't DRMed They are: https://developers.google.com/widevine/drm/overview https://developers.google.com/widevine/drm/overview

sodality2 3y ago
Only for paid products (movies, TV shows, etc). Regular videos (even music videos) do not use WideVine DRM or else no tool would be able to download YouTube videos. (Or at least, public tool - private scene groups do of course have bypasses for it)

Brian_K_White 3y ago

Where is the button on any official YouTube app or web interface that offers to save a local unencrypted file for an anonymous user?

whycome 3y ago
I guess the right click button that allows me to “save link as” is circumventing a websites lack of a “download this image” button?
- Brian_K_White 3y ago
  Yes. Especially when the site uses indirection and js specifically to obstruct it. It doesn't matter that it's not possible to really prevent it, they can demonstrate that they definitely intended to. Locking something with a trivial lock, but still clearly a lock with no other intended purpose but to be a lock, is entirely different from not trying to lock something, when it comes to going to court to claim that someone stole something.