10 ms·

Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf (2022)

756 points by udev4096 2y ago

vvelvetgoldmine 2y ago
[dead]
perching_aix 2y ago
> I discovered that putting a man-in-the-middle proxy between my Apple TV and the world lets me decrypt HTTPS traffic This surprised me quite a bit because normally that shouldn't work, but then that surprise was exchanged for a different one, when I learned later down that you can add CAs to the certificate store of an Apple TV. Nice and thorough writeup, thanks for sharing. A good carousel through the entire stack involved.
- windhaven 2y ago
  If I had to guess why Apple supports adding certificates, it’s probably to allow Apple TVs to work as AirPlay boxes in corporate/educational environments while playing nice with the IT/device management stuff that entails. For instance, when I was in college, getting something on the college WiFi either required allow-listing it’s MAC address or installing a certificate.
  - madeofpalk 2y ago
    This, and the fact that a fair bit of this would 'come for free' due to tvOS being based on iOS which has supported custom CAs for ages.
- codemusings 2y ago
  > [...] when I learned later down that you can add CAs to the certificate store of an Apple TV. Same. I would not have guessed that that's possible but I guess I never tried to access a resource without a valid certificate chain on Apple TV.
- jisnsm 2y ago
  Most devices allow you to add CAs, but almost all apps nowadays use certificate pinning which means the system certificate store is ignored. I find it extremely surprising that YouTube doesn’t do that.
  - mschuster91 2y ago
    > I find it extremely surprising that YouTube doesn’t do that. Not surprising for me - it used to be only banks where it was required (sometimes by law) that any and all communication be intercepted and logged, but this crap (that by definition breaks certificate pinning) is now getting rolled out to even small businesses as part of some cyber-insurance-mandated endpoint/whatever security solution. And Youtube is obviously of the opinion that while bankers aren't enough of a target market to annoy with certificate pinning breaking their background music, ordinary F500 employees are a significant enough target market.
  - AnonHP 2y ago
    > but almost all apps nowadays use certificate pinning which means the system certificate store is ignored Certificate pinning (or rather, public key pinning) is technically obsolete and browsers themselves removed support for it in 2018. [1] Are there many apps still really using this? [1]: https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning
    - klausa 2y ago
      Mobile apps still frequently do, yes. It's gotten less popular over the years as people keep asking "wait, what are we doing this for again?"; but it's still very popular in certain kinds of apps (anything banking related will almost certainly have it, along with easily broken and bypassed jailbreak detections, etc).
    - solarexplorer 2y ago
      I don't have any numbers, but I think this is still pretty common. On iOS for example Alamofire which is a popular network stack, still offers this as a feature. I think the use case is a bit different for apps and web sites, especially for closed ecosystems like Apple's where reverse engineering is not as easy/straightforward. https://github.com/Alamofire/Alamofire https://github.com/Alamofire/Alamofire
- josephg 2y ago
  Unfortunately Google can trivially block this by checking which CA signed their SSL certificate in the YouTube app. I don’t know if they will - doing so might break YouTube within a lot of corporate environments. But it would be unfortunately easy.
  - pbasista 2y ago
    Of course Google can do this. And more. They could, if they wanted, to embed ads into the video stream itself with no way to distinguish them from the actual video content. But they do not do it. They had so much time and opportunities to do that over the years. And yet, they did not do it. I am not going to speculate why. But I suppose it is safe to assume that it is their intention to not do it.
    - ryao 2y ago
      Does anyone do that? The average developer likely would not think to do this because it is too computationally intensive to splice things into A/V streams on the fly. A more clever developer could splice the ad into the video at an I frame, but then the ad needs to be a multiple of the number of frames that are both the I frame and follow the I frame. This also would mess with metadata on the length of the video that would need to be adjusted in advance. It is doable, but you give up flexibility and your HTTP sessions cease to be stateless. Then there is the need to handle splicing into audio and I do not know offhand if there is a cheap way of doing that at the server like you can do with video through I frame splicing. It seems to me that they have lower server costs by doing things the current way.
      - DrFalkyn 2y ago
        YouTube Videos are a stream, not a file you download. I’m not sure what the major technical nurdle is injecting ads directly into the stream. Also H.264 has key frames typically a few sounds apart anyway
      - wingworks 2y ago
        I think twitch embeds their ads. To block there ads you now need to pretend to be in one of the ad-free countries.
- mzajc 2y ago
  Ironically enough Android TV (at least version 7.X) does not let you do that, which I found out the hard way when trying to work around untrusted Let's Encrypt certificates.
  - jeroenhd 2y ago
    Starting with Android 7, apps have to opt into user-installed certificates. Browsers often do (Firefox is an annoying exception, you need to turn it on in the dev settings and it doesn't work in the official release version of the browser), but apps usually don't even know that the setting exists. Aside from that, Android has a very easy certificate pinning API where you can just assign a fingerprint to a domain name in the XML config files and it'll pin a certificate to that domain. Easy to bypass if you modify the APK file, but then you miss out on updates and other mechanisms could check if the signature has been tampered with. With root access (shouldn't be too hard to gain on an Android device still running 7) you can add your certificate to the root certificate folder on the system partition. This will make Let's Encrypt work on all apps. It doesn't bypass certificate pinning, of course, but you don't need there for Let's Encrypt.
- ryao 2y ago
  I remember people promising a rogue CA would not work anymore due to certificate transparency requiring certificates to be published in order to be valid, but it is quite obvious here that certificate transparency was not even needed. A private CA is different from a rogue CA, but if the private CA was not forced to do certificate transparency, I wonder what is supposedly forcing the public CAs to do it for their certificates to be “valid”.
  - vlovich123 2y ago
    > I wonder what is supposedly forcing the public CAs to do it for their certificates to be “valid”. The power of browsers and operating systems including the cert in the default store distributed to everyone. Participating in cert transparency is a requirement.
    - ryao 2y ago
      How is that enforced as it was billed as certificates are not valid unless published, yet it is obvious certificates for a private CA are not being published and are treated as valid?
      - vlovich123 2y ago
        As I understand it there are various interested parties who monitor to make sure that the default CAs in the root store publish to the certificate transparency before they sign anything. A violation would be grounds for immediate removal. None of this applies to a private CA you add to your own store.
mubou 2y ago
> I want to support content creators, so to be fair, after a few months of blocking YouTube ads, I am now paying for YouTube Premium; Just because I can break something, doesn’t mean I need to. Does paying for YouTube Premium support creators? (If so, how much, compared to say Patreon?)
- ozzyphantom 2y ago
  Not much compared to Patreon but if you watch more than a couple YouTubers can you reasonably be expected to subscribe to every YouTuber’s Patreon? I don’t doubt any given YouTube premium subscription provides a negligible amount of income to a creator but watching their videos ad-blocked provides nothing. (I use ublock on Zen and do not make enough money to be a Patron of anyone unfortunately)
  - chii 2y ago
    > watching their videos ad-blocked provides nothing. it provides the view count, for which the creator reaps rewards from as part of the boost in the algorithm from youtube. Not to mention that a lot of creators on youtube also do sponsored segments.
    - debian3 2y ago
      And that’s why there is SponsorBlock
      - hhh 2y ago
        which has horrible issues with moderation and zealots over-blocking random things in videos
        netsharc 2y ago
        I've seen a Linus Tech Tips video where the seekbar was very colorful due to SponsorBlock, someone added all the sponsors, product placement and tangents into it. I admit I've marked segments on videos, e.g. skipping cringy jokes when I find the presenter annoying.
abricq 2y ago
I really like everything related to network-wide blocking of shitty online services that are enforced on us ! On top of blocking adds (which is great), I wish there were more / easier ways to do network-wide blocking of all sorts of aggressive infinite scrolling (in my case : youtube shorts and instagram reels). I often like to go on instagram to see posts / stories from the people I follow and I don't want to be suggested stupid videos that are especially designed to catch my attention. I know it's probably revealing a lack of strength on my side, but yeah, I often fall for watching a few of them and loosing 15 minutes of my life.
- arnvidr 2y ago
  Hit that "For you" at the top and select the "Following" feed. Only the posts from the people you follow, no suggested posts, no ads.
  - rwmj 2y ago
    Until the company decides to unilaterally reenable that setting to "help you get more from their service".
  - david_arcos 2y ago
    That's not persistent :(
  - bossyTeacher 2y ago
    can't find that button
- soraminazuki 2y ago
  YouTube still provides RSS feeds for individual channels. Combine that with mpv's yt-dlp integration and you can avoid the official web frontend altogether. I don't know how long it's going to last though, with the current trend of rug pulls and enshittification.
  - ffsm8 2y ago
    Pretty sure it's only gonna get deleted if either a) enough people use it so that a MBAs notice or b) the way it's accessing the data blocks a feature that an MBA wants
Zephyrix 2y ago
I’ve tried implementing this a few times on my Apple TV to no avail. I think YouTube has implemented cert pinning on their app now or something. Has anyone else been able to get this working recently?
- alphan0n 2y ago
  If your willing to dedicate some time, dig into Frida [0], pinned certs are not a problem. [0] https://frida.re/docs/home/ https://frida.re/docs/home/
Jiahang 2y ago
what about in openwrt？
throwawayffffas 2y ago
So I have to ask, I am legitimately curious, how is AppleTV better than hooking up a laptop with an air mouse on your TV?
- sussmannbaka 2y ago
  Mostly because there is no laptop hooked up to your TV. I wouldn’t want to have a laptop standing around, which is mostly an aesthetic choice.
  - JKCalhoun 2y ago
    Yeah, basically the size of a hockey puck. And priced a lot lower than a laptop of course.
- angulardragon03 2y ago
  Lower power consumption, actual 10-foot interface rather than squinting at the TV, lower maintenance, and (depending on your OS of choice) less intrusive OS-level advertising.
- jonathanlydall 2y ago
  In addition to the sibling comment, it also: - Comes with a simple remote control which in addition to controlling the AppleTV also allows muting and changing the volume of your TV. As someone who uses my TV exclusively with the AppleTV this means my TV's remote simply sits in a cupboard. - If you have an iPhone you can use it as a remote over WiFi, I do this all the time to turn off the TV from a room over when the kids need to stop watching. The iPhone can also act as a remote keyboard which can be very convenient for text input. - The voice search feature works very well in my experience. The remote has a mic in it and you simply hold one button and dictate what you're searching for and 99% of the time for me it works perfectly. - It's very fast and responsive, allows quick and easy switching between apps. - It's popular such that any streaming provider probably has an app for it.
  - skydhash 2y ago
05 2y ago
YT Premium is $140/year (unless you know someone with an Indian credit card :), it's cheaper to buy a $100/yr Apple Developer sub, patch the app and sign with your cert.
- dtech 2y ago
  It's $0 to go to Bittorrent and download movies, it's $0 to use adblocker and not have Youtube premium. There will almost always be piracy or piracy-adjacent cheaper options.
  - heraldgeezer 2y ago
    Shows how this is the typical HN article of nonsense that is not applicable to real life. Why hack your Apple TV like this, so you can afford an Apple TV but not YT premium? Or just use adblocker. For movies yea Bittorrent is alive and well not that I would know :)
    - skyyler 2y ago
      >so you can afford an Apple TV but not YT premium? How many months of YT Premium does it take to exceed the cost of the Apple TV? They're like $150...
      - heraldgeezer 2y ago
        Yes sure, but if you want to hack things, just get something Android based that lets you side load or instal whatever you want.
        skyyler 2y ago
        But I like hacking Apple things :3
  - rs186 2y ago
    Arguably you want to spend a bit more than $0, e.g. a good VPN or a good seedbox. And VPNs can be as expensive as YouTube premium. (That said, VPNs have other uses, but "most people" probably don't really use VPNs much anyway)
llui85 2y ago
(2022)
- HelloUsername 2y ago
  Previous discussion: https://news.ycombinator.com/item?id=37279109 https://news.ycombinator.com/item?id=37279109
vitus 2y ago
> instead, I found a flaw in the Protobuf format which allows me to reliably change one byte to obliterate ads. Let me guess, the author changed the field number to a large unused number. > Now, all we have to do is scan the Protobuf bytes for classic ad URL signatures like /pagead/ to bound our field search, then move backward from there until we find the target(s) field tags and thus field keys we would like to denature (e.g. 49399797 –> 49399796). Yeah. This isn't a flaw, this is intended behavior. If you're willing to go through the effort to find the tag, it's really not that much additional effort to then read the (varint) length right next to the tag and... just skip those bytes. Yes, you'd need to copy your buffer to do this, or at least slide your bytes around. But the proof-of-concept script already has to perform a copy because the bytes object returned by mitmproxy's API (`body: bytearray = bytearray(flow.response.get_content(strict=False) or b"")`) is immutable, and even a memoryview isn't going to bypass this limitation.
- jeroenhd 2y ago
  On the protocol level everything is working as expected, but I think the flaw is that Google's way of dealing with these unknown fields in the ad data structure isn't to throw an error, but to pretend there are no ads to play. After all, Google will definitely release a new version of their app before they modify the protocol to make all the old versions not play ads anymore. Google could shut down this method of ad blocking instantly by either doing basic certificate pinning or by altering their decoding logic to be less graceful of failures when it comes to extracting ad information. If I were on the YouTube team, I'd consider these flaws.
  - wongarsu 2y ago
    Smoothly handling missing or unexpected fields is half the value proposition of protobuf. May as well switch a a much simpler versioned binary protocol instead of all this schema and field tagging complexity if you want to reject every message that doesn't match the client's schema. But rejecting unknown messages would likely degrade the user experience. Just because Google releases a new version doesn't mean everyone instantly has that new version installed everywhere. Certificate pinning would be a solution, but the world seems to have decided that that's very difficult to get right. Probably easier to get right in an app than in a website, but I understand not using it. They could manually sign the protobuf messages to ensure integrity. Duplicating some of the work TLS would already do, but doing it decoupled from TLS infrastructure may be easier. But unless something like OP's hack becomes mainstream, Google's current approach could be the right one. Sure, it leaves them open to message manipulation, but the potential lost ad revenue from even a tiny failure rate around update time from the other approaches could easily outweigh what they lose from a handful of people running middleware boxes to block ads.
heraldgeezer 2y ago
The typical HN article of nonsense that is not applicable to real life. Why hack your Apple TV like this, so you can afford an Apple TV but not YT Premium? Or just use adblocker ublcok origin with a PC then instead. For movies yea Bittorrent is alive and well not that I would know :)
- kortex 2y ago
  > The typical [HACKERnews] article [about hacking] that is applicable to [computer enthusiasts]. Fixed that for you.
vachina 2y ago
My gf’s YouTube account for some reason does not show ads on any device it is logged in, including the Apple TV. It is not premium, nor ever was premium. Wonder what flag is set internally that disabled ads.
- choo-t 2y ago
  Afaik Youtube cannot legally display ads to some countries' residents, it could explain this behavior.
  - fastball 2y ago
    Presumably he lives in the same place as his girlfriend.
    - choo-t 2y ago
      She may have created the account abroad.
      - zeroadsever 2y ago
        Which begs the question: if you used a proxy server/VPN and created an account "overseas", would you get ads?
    - deleted 2y ago
      [deleted]
  - zeroadsever 2y ago
    The above is true. Some countries don't get ads. Lucky them. Albania, Cambodia, Ivory Coast, Laos, Myanmar, Macau, Madagascar, Maldives, and Russia. Use a proxy server/VPN and go ad free.
  - anticensor 2y ago
    Why don't they serve placeholder unpaid noncommercial ads (YouTube features, government services) to such users instead?
dmos62 2y ago
Love the engineering, but it's kind of sad the hoops we have to jump through to get some semblence of owning our hardware or software.
- rchaud 2y ago
  Any $30 Android shitbox with a nieuwpipe apk has been able to do this for ~ 10 years.
- duxup 2y ago
  Well you own the device in this case. I don’t think there’s a justification to arguing you own YouTube or the content.
  - dmos62 2y ago
    > I don’t think there’s a justification to arguing you own YouTube or the content. This actually gets to the core of my sentiment. I am influenced by these systems, but I can't directly influence them back. I don't know if this is somehow wrong in principle, but I definitely want more.
    - duxup 2y ago
      As an individual viewer of course the creator of the content is the one with influence. There's potentially millions of viewers, there's no magic influence that you'd ever notice.
      - dmos62 2y ago
        By "system", I was referring to the middleman infrastructure (Youtube, in this case).
    - HumblyTossed 2y ago
      > but I can't directly influence them back. Opting out of viewing is directly influencing.
  - 2y ago
gytisgreitai 2y ago
I need this for openwrt:)
- baggachipz 2y ago
  I need this for my pihole!
mschoch 2y ago
[dead]
timcobb 2y ago
If we're getting to the point where we need to decrypt things and reverse engineer protocols, maybe we should... not use these devices? Maybe we should opt out of this economy? Maybe we should do other things to entertain ourselves?
- lordleft 2y ago
  I've started reading a great deal more. I'm tired of wrangling with my entertainment.
  - selykg 2y ago
    I started reading a great deal more at the start of the pandemic. I've kept it going since and it has been a real boon. I also switched back to physical books because I actually own them..
- ajsnigrutin 2y ago
  The problem is, that there is no alternative yet for that. Movies are not an issue, there's piracy, music is not an issue, there's piracy, books are not an issue, there are libraries... and piracy, but youtube is still limited, and the only way to avoid the ads is to buy another device (computer), thus turning pretty much any smarttv (with features you paid for) into a dumb display (that you mostly cannot even buy anymore).
  - timcobb 2y ago
    Alternatives: - Not consuming exploitative entertainment - "Piracy"
  - alistairSH 2y ago
    Piracy isn't an alternative - it's illegal/immoral. But, the good news is there are two alternatives for all of the above... pay for the content. Or, don't consume the content.
    - ajsnigrutin 2y ago
lima 2y ago
A small C++/Go/... proxy can do the same thing with much, much less overhead. Been there, done that - for something well-defined like this, it is more stable and less work than fighting mitmproxy. Routing everything through the proxy will degrade performance even with SNI interception. Same with pfSense - a plain Linux server and a simple iptables rules set would do the job without having to fight against all the pfSense abstraction layers. Write a .proto file with just enough of the reverse-engineered proto fields to auto-generate code and flip the flag. Cheaper than the Python implementation and easier to update when the proto changes. Ignoring unknown field tags is an important Protobuf feature - it allows for compatible schema changes without breaking existing deployments.
- pcardoso 2y ago
  I would love to degrade my YouTube experience and make it slower when switching videos, would make it a lot less addictive specially with shorts.
  - brainzap 2y ago
    I am experimenting a bit and definitly, a little bit loading delay helps to break the loop and „wake up“
    - ushiroda80 2y ago
      21th century will be remembered as the great digital drug crisis.
      - catlikesshrimp 2y ago
        Or the Start of the Digital Drug Era.
      - haagendos 2y ago
        [dead]
      - layer8 2y ago
scottydelta 2y ago
Just the other day I was discussing similar approach to remove political content from Reddit app. On Reddit, all the subreddits are constantly bombarded with Trump/Elon/Political content and there is currently no way to mute that content on mobile. It would be cool if someone can come up with a raspberry pi based system to do this for reddit.
uptown 2y ago
I don't use it all that much, but the one feature I wish I had was the ability to scrub forward or backwards at will on an Instagram video.
freeAgent 2y ago
I block YouTube ads on all my devices by paying for YouTube Premium. It feels refreshing to be able to pay for a service I enjoy and therefore not be served ads which I don’t enjoy. It seems like a win-win to me. Doing something like this, while technically interestingly, seems like far more trouble than it’s worth for 99.99% of people, especially when there’s a reasonably priced way to block ads that also supports the service.
- a12k 2y ago
  I paid for YouTube Premium and still got ads, though fewer. So I cancelled. Are they now offering YT Premium ad free?
  - neilo40 2y ago
    I haven’t seen a single ad in over a year. You still get paid sponsorships depending on the channel though
  - millerm 2y ago
    I’ve been paying for premium, basically because they’ve been sort of forcing to people with the ridiculous number of ads. I get zero ads injected. You’ll still get sponsorships that are part of the video done by the creator, which is now become a little bit more annoying. But at least it’s something that the content creator completely approves of and endorses. I can skip that part anyway. I’ll probably cancel it soon, only because I need to stop watching so much of this stuff, and I need to get rid of things in life that I shouldn’t be paying for. Once I do that, I’ll never be able to watch YouTube again, because it was unbearable with the number of ads injected. I hate being reminded over and over that I am nothing but a consumer that they try to influence with ads over, amd over, and over, and over. Off-topic, I recently got another free month of Amazon prime. I was watching some shows on there, and the ads are f’n annoying there too. I can’t believe they make people pay more now to remove the ads. I’ll never pay for Prime in any fashion.
  - voxic11 2y ago
    I have paid for YouTube Premium for years and watch YouTube nearly every day and I have never seen an ad from YouTube (you still may see baked-in ads from the video creator but those can be automatically skipped with the SponsorBlock extension).
metabrew 2y ago
I would love to pay for youtube premium, but i have a google workspace/apps/own-domain/whatever the hell they call it now account, and loads of stuff (like youtube premium) isn't supported.
- neilo40 2y ago
  I had that issue. I just created a new account solely for YouTube
- Havoc 2y ago
  Same. It’s wild that Google can’t sort that out
- carlosjobim 2y ago
  Make another account.
shidoshi 2y ago
Lots of social commentary here, but I'd just note you're one mad lad. This is a great writeup and a nifty bit of sleuthing. I found it enjoyable to read.
Telemakhos 2y ago
There are ads on YouTube? I guess my browser blocks them so well that I didn’t know. The real problem here is that the AppleTV experience is so much worse than an ordinary web browser experience. Apple locked the hardware down to the point that it benefits YouTube’s ad profits more than it benefits the end consumer who pays for it.
- focusedone 2y ago
  I never see ads on Linux, Windows or Android. Occasionally I try to watch YouTube on an iPad and am shocked at how frequent and irritating the ads are. Same with browsing the web on an iPad outside of the home pi-hole'd network. Howwww do people deal with this every day? The iPad is a work-issued device so I don't often use it for personal things. Every time I do it's a reminder of how irritating it is to do so. It's kindof odd; before being issued an iPad I thought they were only useful as content consumption devices. Turns out it's super handy for quick remote access to work resources but locked to an ad-infested wasteland for general web browsing and streaming media. Who knew?
Terretta 2y ago
This is a novella that just keeps getting twistier, going deeper, and turning out more rewarding. And clearly all these "reasoning" LLMs trained heavily on Eric Draken's refreshingly introspective monologue full of interjections and discoveries.
not_your_mentat 2y ago
Does this work for Amazon Prime as well? I installed AdGuard Home last night and these two have been the only outliers so far.
Havoc 2y ago
Nice to see a writeup that includes the failures too
vincnetas 2y ago
note that GDPR consent section on the site is invalid, it does not have "decline" button. so might as well just get rid of it.
thomasfl 2y ago
For ad free Youtube, go to https://yewtu.be https://yewtu.be or any other Invidious instances https://docs.invidious.io/instances/ https://docs.invidious.io/instances/ There is an arms race between YouTube and Invidious. From time to time Invidious is not working, but the team has always found new ways to circumvent YouTube and deliver the videos without ads.
- orliesaurus 2y ago
  This wouldn't work on Roku TVs etc since there's no "browser" :(
- xela79 2y ago
  there's a reason the author included "on AppleTV" in the title. Alternative clients/frontends etc simply don't work
  - skyyler 2y ago
    Well, other than this one: https://apps.apple.com/us/app/yattee/id1595136629 https://apps.apple.com/us/app/yattee/id1595136629 https://github.com/yattee/yattee https://github.com/yattee/yattee The UX is not great, though.
greenpizza13 2y ago
Or simply pay for YouTube. They provide a service, it’s not our job as technologists to enable stealing it.
- arnath 2y ago
  I mean, they provide the service by stealing data from their users. I would argue that this is just as ethically fine as Youtube's entire business model.
- DavideNL 2y ago
  ... if there'd be a healthy amount of alternatives/competitors to chose from, that would probably be true. However, as we all know, it's basically a monopoly.
  - carlosjobim 2y ago
    Absolutely! When you discount for cable tv, satellite tv, airborne tv, Netflix, Amazon, HBO, Disney and others. Because we are hackers and everything we don't like (or don't want to pay for) is automatically a "monopoly".
b8 2y ago
Now for someone to figure out blocking FireTV OS
j45 2y ago
YouTube is hard to watch with ads once you’ve watched it without ads for a long time. Neat post to learn about the current way the video stream works. Has anyone else found enough utility in paying for a YouTube premium acct maybe for their entire household vs other streaming services?
deleted 2y ago
[deleted]
Fokamul 2y ago
I've opted to installing opensource youtube app with Adblock and sponsor block. LGTV Webos is so great, there is easy way to become "developer" and it will open official way to install homebrew apps on your own TV. Yeah, since you own it, it can be possible to do what you want with it. Fu** you to all Golden-cage devices like Apple, Samsung, etc.
- giancarlostoro 2y ago
  I prefer not to use the OS on my TVs and opt for never letting them online, I just hook up my Apple TV to it, this gives me complete control over my TV as things should be.
m3kw9 2y ago
This article is crazy engineering work
RKFADU_UOFCCLEL 2y ago
Why would this be possible without pwning a CA? If so they can just patch it the day after they discover this article. There's no reason to do this anyway when you can just plug a video out from a PC to the TV.
- bathtub365 2y ago
  A PC isn’t an Apple TV
cryptonector 2y ago
YouTube will detect when you don't stream their ads and will ask you to disable your ad blocker and comment as to what's up.
DrNosferatu 2y ago
…or get an Android TV box and run Tubular ;)
m463 2y ago
why does it say proFobuf? mistake?
aurareturn 2y ago
Hacker News community: I hate ads and I'd rather pay for the service instead of ads. Also Hacker News community: F paying for the service, let's block the ads instead and get the service for free.
nullbio 2y ago
Speaking of Youtube, why does no one ever seem to bring up the fact that they shadow-delete half the comments people leave? It's such a garbage platform, it's a real shame they have no serious competition.
- 42772827 2y ago
  Is it YouTube who does this or the creators who post the content?
ushtaritk421 2y ago
Cool project, but on a practical level it seems like a lot of trouble just to avoid paying for premium
buyucu 2y ago
this is very easy on all non-apple systems just by installing uBlock or newpipe. Why is it so hard on Apple?
Alpha4262 2y ago
[dead]
Gradier5765 2y ago
[dead]

756 points by udev4096 2y ago

[dead]

> I discovered that putting a man-in-the-middle proxy between my Apple TV and the world lets me decrypt HTTPS traffic This surprised me quite a bit because normally that shouldn't work, but then that surprise was exchanged for a different one, when I learned later down that you can add CAs to the certificate store of an Apple TV. Nice and thorough writeup, thanks for sharing. A good carousel through the entire stack involved.

windhaven 2y ago
If I had to guess why Apple supports adding certificates, it’s probably to allow Apple TVs to work as AirPlay boxes in corporate/educational environments while playing nice with the IT/device management stuff that entails. For instance, when I was in college, getting something on the college WiFi either required allow-listing it’s MAC address or installing a certificate.
- madeofpalk 2y ago
  This, and the fact that a fair bit of this would 'come for free' due to tvOS being based on iOS which has supported custom CAs for ages.
codemusings 2y ago
> [...] when I learned later down that you can add CAs to the certificate store of an Apple TV. Same. I would not have guessed that that's possible but I guess I never tried to access a resource without a valid certificate chain on Apple TV.
jisnsm 2y ago
Most devices allow you to add CAs, but almost all apps nowadays use certificate pinning which means the system certificate store is ignored. I find it extremely surprising that YouTube doesn’t do that.
- mschuster91 2y ago
  > I find it extremely surprising that YouTube doesn’t do that. Not surprising for me - it used to be only banks where it was required (sometimes by law) that any and all communication be intercepted and logged, but this crap (that by definition breaks certificate pinning) is now getting rolled out to even small businesses as part of some cyber-insurance-mandated endpoint/whatever security solution. And Youtube is obviously of the opinion that while bankers aren't enough of a target market to annoy with certificate pinning breaking their background music, ordinary F500 employees are a significant enough target market.
- AnonHP 2y ago
  > but almost all apps nowadays use certificate pinning which means the system certificate store is ignored Certificate pinning (or rather, public key pinning) is technically obsolete and browsers themselves removed support for it in 2018. [1] Are there many apps still really using this? [1]: https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning
  - klausa 2y ago
    Mobile apps still frequently do, yes. It's gotten less popular over the years as people keep asking "wait, what are we doing this for again?"; but it's still very popular in certain kinds of apps (anything banking related will almost certainly have it, along with easily broken and bypassed jailbreak detections, etc).
  - solarexplorer 2y ago
    I don't have any numbers, but I think this is still pretty common. On iOS for example Alamofire which is a popular network stack, still offers this as a feature. I think the use case is a bit different for apps and web sites, especially for closed ecosystems like Apple's where reverse engineering is not as easy/straightforward. https://github.com/Alamofire/Alamofire https://github.com/Alamofire/Alamofire
josephg 2y ago
Unfortunately Google can trivially block this by checking which CA signed their SSL certificate in the YouTube app. I don’t know if they will - doing so might break YouTube within a lot of corporate environments. But it would be unfortunately easy.
- pbasista 2y ago
  Of course Google can do this. And more. They could, if they wanted, to embed ads into the video stream itself with no way to distinguish them from the actual video content. But they do not do it. They had so much time and opportunities to do that over the years. And yet, they did not do it. I am not going to speculate why. But I suppose it is safe to assume that it is their intention to not do it.
  - ryao 2y ago
    Does anyone do that? The average developer likely would not think to do this because it is too computationally intensive to splice things into A/V streams on the fly. A more clever developer could splice the ad into the video at an I frame, but then the ad needs to be a multiple of the number of frames that are both the I frame and follow the I frame. This also would mess with metadata on the length of the video that would need to be adjusted in advance. It is doable, but you give up flexibility and your HTTP sessions cease to be stateless. Then there is the need to handle splicing into audio and I do not know offhand if there is a cheap way of doing that at the server like you can do with video through I frame splicing. It seems to me that they have lower server costs by doing things the current way.
    - DrFalkyn 2y ago
      YouTube Videos are a stream, not a file you download. I’m not sure what the major technical nurdle is injecting ads directly into the stream. Also H.264 has key frames typically a few sounds apart anyway
    - wingworks 2y ago
      I think twitch embeds their ads. To block there ads you now need to pretend to be in one of the ad-free countries.
mzajc 2y ago
Ironically enough Android TV (at least version 7.X) does not let you do that, which I found out the hard way when trying to work around untrusted Let's Encrypt certificates.
- jeroenhd 2y ago
  Starting with Android 7, apps have to opt into user-installed certificates. Browsers often do (Firefox is an annoying exception, you need to turn it on in the dev settings and it doesn't work in the official release version of the browser), but apps usually don't even know that the setting exists. Aside from that, Android has a very easy certificate pinning API where you can just assign a fingerprint to a domain name in the XML config files and it'll pin a certificate to that domain. Easy to bypass if you modify the APK file, but then you miss out on updates and other mechanisms could check if the signature has been tampered with. With root access (shouldn't be too hard to gain on an Android device still running 7) you can add your certificate to the root certificate folder on the system partition. This will make Let's Encrypt work on all apps. It doesn't bypass certificate pinning, of course, but you don't need there for Let's Encrypt.
ryao 2y ago
I remember people promising a rogue CA would not work anymore due to certificate transparency requiring certificates to be published in order to be valid, but it is quite obvious here that certificate transparency was not even needed. A private CA is different from a rogue CA, but if the private CA was not forced to do certificate transparency, I wonder what is supposedly forcing the public CAs to do it for their certificates to be “valid”.
- vlovich123 2y ago
  > I wonder what is supposedly forcing the public CAs to do it for their certificates to be “valid”. The power of browsers and operating systems including the cert in the default store distributed to everyone. Participating in cert transparency is a requirement.
  - ryao 2y ago
    How is that enforced as it was billed as certificates are not valid unless published, yet it is obvious certificates for a private CA are not being published and are treated as valid?
    - vlovich123 2y ago
      As I understand it there are various interested parties who monitor to make sure that the default CAs in the root store publish to the certificate transparency before they sign anything. A violation would be grounds for immediate removal. None of this applies to a private CA you add to your own store.

mubou 2y ago

> I want to support content creators, so to be fair, after a few months of blocking YouTube ads, I am now paying for YouTube Premium; Just because I can break something, doesn’t mean I need to. Does paying for YouTube Premium support creators? (If so, how much, compared to say Patreon?)

ozzyphantom 2y ago
Not much compared to Patreon but if you watch more than a couple YouTubers can you reasonably be expected to subscribe to every YouTuber’s Patreon? I don’t doubt any given YouTube premium subscription provides a negligible amount of income to a creator but watching their videos ad-blocked provides nothing. (I use ublock on Zen and do not make enough money to be a Patron of anyone unfortunately)
- chii 2y ago
  > watching their videos ad-blocked provides nothing. it provides the view count, for which the creator reaps rewards from as part of the boost in the algorithm from youtube. Not to mention that a lot of creators on youtube also do sponsored segments.
  - debian3 2y ago
    And that’s why there is SponsorBlock
    - hhh 2y ago
      which has horrible issues with moderation and zealots over-blocking random things in videos
      - netsharc 2y ago
        I've seen a Linus Tech Tips video where the seekbar was very colorful due to SponsorBlock, someone added all the sponsors, product placement and tangents into it. I admit I've marked segments on videos, e.g. skipping cringy jokes when I find the presenter annoying.

abricq 2y ago

I really like everything related to network-wide blocking of shitty online services that are enforced on us ! On top of blocking adds (which is great), I wish there were more / easier ways to do network-wide blocking of all sorts of aggressive infinite scrolling (in my case : youtube shorts and instagram reels). I often like to go on instagram to see posts / stories from the people I follow and I don't want to be suggested stupid videos that are especially designed to catch my attention. I know it's probably revealing a lack of strength on my side, but yeah, I often fall for watching a few of them and loosing 15 minutes of my life.

arnvidr 2y ago
Hit that "For you" at the top and select the "Following" feed. Only the posts from the people you follow, no suggested posts, no ads.
- rwmj 2y ago
  Until the company decides to unilaterally reenable that setting to "help you get more from their service".
- david_arcos 2y ago
  That's not persistent :(
- bossyTeacher 2y ago
  can't find that button
soraminazuki 2y ago
YouTube still provides RSS feeds for individual channels. Combine that with mpv's yt-dlp integration and you can avoid the official web frontend altogether. I don't know how long it's going to last though, with the current trend of rug pulls and enshittification.
- ffsm8 2y ago
  Pretty sure it's only gonna get deleted if either a) enough people use it so that a MBAs notice or b) the way it's accessing the data blocks a feature that an MBA wants

Zephyrix 2y ago

I’ve tried implementing this a few times on my Apple TV to no avail. I think YouTube has implemented cert pinning on their app now or something. Has anyone else been able to get this working recently?

alphan0n 2y ago
If your willing to dedicate some time, dig into Frida [0], pinned certs are not a problem. [0] https://frida.re/docs/home/ https://frida.re/docs/home/

Jiahang 2y ago

what about in openwrt？

throwawayffffas 2y ago

So I have to ask, I am legitimately curious, how is AppleTV better than hooking up a laptop with an air mouse on your TV?

sussmannbaka 2y ago
Mostly because there is no laptop hooked up to your TV. I wouldn’t want to have a laptop standing around, which is mostly an aesthetic choice.
- JKCalhoun 2y ago
  Yeah, basically the size of a hockey puck. And priced a lot lower than a laptop of course.
angulardragon03 2y ago
Lower power consumption, actual 10-foot interface rather than squinting at the TV, lower maintenance, and (depending on your OS of choice) less intrusive OS-level advertising.
jonathanlydall 2y ago
In addition to the sibling comment, it also: - Comes with a simple remote control which in addition to controlling the AppleTV also allows muting and changing the volume of your TV. As someone who uses my TV exclusively with the AppleTV this means my TV's remote simply sits in a cupboard. - If you have an iPhone you can use it as a remote over WiFi, I do this all the time to turn off the TV from a room over when the kids need to stop watching. The iPhone can also act as a remote keyboard which can be very convenient for text input. - The voice search feature works very well in my experience. The remote has a mic in it and you simply hold one button and dictate what you're searching for and 99% of the time for me it works perfectly. - It's very fast and responsive, allows quick and easy switching between apps. - It's popular such that any streaming provider probably has an app for it.
- skydhash 2y ago

05 2y ago

YT Premium is $140/year (unless you know someone with an Indian credit card :), it's cheaper to buy a $100/yr Apple Developer sub, patch the app and sign with your cert.

dtech 2y ago
It's $0 to go to Bittorrent and download movies, it's $0 to use adblocker and not have Youtube premium. There will almost always be piracy or piracy-adjacent cheaper options.
- heraldgeezer 2y ago
  Shows how this is the typical HN article of nonsense that is not applicable to real life. Why hack your Apple TV like this, so you can afford an Apple TV but not YT premium? Or just use adblocker. For movies yea Bittorrent is alive and well not that I would know :)
  - skyyler 2y ago
    >so you can afford an Apple TV but not YT premium? How many months of YT Premium does it take to exceed the cost of the Apple TV? They're like $150...
    - heraldgeezer 2y ago
      Yes sure, but if you want to hack things, just get something Android based that lets you side load or instal whatever you want.
      - skyyler 2y ago
        But I like hacking Apple things :3
- rs186 2y ago
  Arguably you want to spend a bit more than $0, e.g. a good VPN or a good seedbox. And VPNs can be as expensive as YouTube premium. (That said, VPNs have other uses, but "most people" probably don't really use VPNs much anyway)

llui85 2y ago

(2022)

HelloUsername 2y ago
Previous discussion: https://news.ycombinator.com/item?id=37279109 https://news.ycombinator.com/item?id=37279109

vitus 2y ago

> instead, I found a flaw in the Protobuf format which allows me to reliably change one byte to obliterate ads. Let me guess, the author changed the field number to a large unused number. > Now, all we have to do is scan the Protobuf bytes for classic ad URL signatures like /pagead/ to bound our field search, then move backward from there until we find the target(s) field tags and thus field keys we would like to denature (e.g. 49399797 –> 49399796). Yeah. This isn't a flaw, this is intended behavior. If you're willing to go through the effort to find the tag, it's really not that much additional effort to then read the (varint) length right next to the tag and... just skip those bytes. Yes, you'd need to copy your buffer to do this, or at least slide your bytes around. But the proof-of-concept script already has to perform a copy because the bytes object returned by mitmproxy's API (`body: bytearray = bytearray(flow.response.get_content(strict=False) or b"")`) is immutable, and even a memoryview isn't going to bypass this limitation.

jeroenhd 2y ago
On the protocol level everything is working as expected, but I think the flaw is that Google's way of dealing with these unknown fields in the ad data structure isn't to throw an error, but to pretend there are no ads to play. After all, Google will definitely release a new version of their app before they modify the protocol to make all the old versions not play ads anymore. Google could shut down this method of ad blocking instantly by either doing basic certificate pinning or by altering their decoding logic to be less graceful of failures when it comes to extracting ad information. If I were on the YouTube team, I'd consider these flaws.
- wongarsu 2y ago
  Smoothly handling missing or unexpected fields is half the value proposition of protobuf. May as well switch a a much simpler versioned binary protocol instead of all this schema and field tagging complexity if you want to reject every message that doesn't match the client's schema. But rejecting unknown messages would likely degrade the user experience. Just because Google releases a new version doesn't mean everyone instantly has that new version installed everywhere. Certificate pinning would be a solution, but the world seems to have decided that that's very difficult to get right. Probably easier to get right in an app than in a website, but I understand not using it. They could manually sign the protobuf messages to ensure integrity. Duplicating some of the work TLS would already do, but doing it decoupled from TLS infrastructure may be easier. But unless something like OP's hack becomes mainstream, Google's current approach could be the right one. Sure, it leaves them open to message manipulation, but the potential lost ad revenue from even a tiny failure rate around update time from the other approaches could easily outweigh what they lose from a handful of people running middleware boxes to block ads.

heraldgeezer 2y ago

The typical HN article of nonsense that is not applicable to real life. Why hack your Apple TV like this, so you can afford an Apple TV but not YT Premium? Or just use adblocker ublcok origin with a PC then instead. For movies yea Bittorrent is alive and well not that I would know :)

kortex 2y ago
> The typical [HACKERnews] article [about hacking] that is applicable to [computer enthusiasts]. Fixed that for you.

vachina 2y ago

My gf’s YouTube account for some reason does not show ads on any device it is logged in, including the Apple TV. It is not premium, nor ever was premium. Wonder what flag is set internally that disabled ads.

choo-t 2y ago
Afaik Youtube cannot legally display ads to some countries' residents, it could explain this behavior.
- fastball 2y ago
  Presumably he lives in the same place as his girlfriend.
  - choo-t 2y ago
    She may have created the account abroad.
    - zeroadsever 2y ago
      Which begs the question: if you used a proxy server/VPN and created an account "overseas", would you get ads?
  - deleted 2y ago
    [deleted]
- zeroadsever 2y ago
  The above is true. Some countries don't get ads. Lucky them. Albania, Cambodia, Ivory Coast, Laos, Myanmar, Macau, Madagascar, Maldives, and Russia. Use a proxy server/VPN and go ad free.
- anticensor 2y ago
  Why don't they serve placeholder unpaid noncommercial ads (YouTube features, government services) to such users instead?

dmos62 2y ago

Love the engineering, but it's kind of sad the hoops we have to jump through to get some semblence of owning our hardware or software.

rchaud 2y ago
Any $30 Android shitbox with a nieuwpipe apk has been able to do this for ~ 10 years.
duxup 2y ago
Well you own the device in this case. I don’t think there’s a justification to arguing you own YouTube or the content.
- dmos62 2y ago
  > I don’t think there’s a justification to arguing you own YouTube or the content. This actually gets to the core of my sentiment. I am influenced by these systems, but I can't directly influence them back. I don't know if this is somehow wrong in principle, but I definitely want more.
  - duxup 2y ago
    As an individual viewer of course the creator of the content is the one with influence. There's potentially millions of viewers, there's no magic influence that you'd ever notice.
    - dmos62 2y ago
      By "system", I was referring to the middleman infrastructure (Youtube, in this case).
  - HumblyTossed 2y ago
    > but I can't directly influence them back. Opting out of viewing is directly influencing.
- 2y ago

gytisgreitai 2y ago

I need this for openwrt:)

baggachipz 2y ago
I need this for my pihole!

mschoch 2y ago

[dead]

timcobb 2y ago

If we're getting to the point where we need to decrypt things and reverse engineer protocols, maybe we should... not use these devices? Maybe we should opt out of this economy? Maybe we should do other things to entertain ourselves?

lordleft 2y ago
I've started reading a great deal more. I'm tired of wrangling with my entertainment.
- selykg 2y ago
  I started reading a great deal more at the start of the pandemic. I've kept it going since and it has been a real boon. I also switched back to physical books because I actually own them..
ajsnigrutin 2y ago
The problem is, that there is no alternative yet for that. Movies are not an issue, there's piracy, music is not an issue, there's piracy, books are not an issue, there are libraries... and piracy, but youtube is still limited, and the only way to avoid the ads is to buy another device (computer), thus turning pretty much any smarttv (with features you paid for) into a dumb display (that you mostly cannot even buy anymore).
- timcobb 2y ago
  Alternatives: - Not consuming exploitative entertainment - "Piracy"
- alistairSH 2y ago
  Piracy isn't an alternative - it's illegal/immoral. But, the good news is there are two alternatives for all of the above... pay for the content. Or, don't consume the content.
  - ajsnigrutin 2y ago

lima 2y ago

A small C++/Go/... proxy can do the same thing with much, much less overhead. Been there, done that - for something well-defined like this, it is more stable and less work than fighting mitmproxy. Routing everything through the proxy will degrade performance even with SNI interception. Same with pfSense - a plain Linux server and a simple iptables rules set would do the job without having to fight against all the pfSense abstraction layers. Write a .proto file with just enough of the reverse-engineered proto fields to auto-generate code and flip the flag. Cheaper than the Python implementation and easier to update when the proto changes. Ignoring unknown field tags is an important Protobuf feature - it allows for compatible schema changes without breaking existing deployments.

pcardoso 2y ago
I would love to degrade my YouTube experience and make it slower when switching videos, would make it a lot less addictive specially with shorts.
- brainzap 2y ago
  I am experimenting a bit and definitly, a little bit loading delay helps to break the loop and „wake up“
  - ushiroda80 2y ago
    21th century will be remembered as the great digital drug crisis.
    - catlikesshrimp 2y ago
      Or the Start of the Digital Drug Era.
    - haagendos 2y ago
      [dead]
    - layer8 2y ago

scottydelta 2y ago

Just the other day I was discussing similar approach to remove political content from Reddit app. On Reddit, all the subreddits are constantly bombarded with Trump/Elon/Political content and there is currently no way to mute that content on mobile. It would be cool if someone can come up with a raspberry pi based system to do this for reddit.

uptown 2y ago

I don't use it all that much, but the one feature I wish I had was the ability to scrub forward or backwards at will on an Instagram video.

freeAgent 2y ago

I block YouTube ads on all my devices by paying for YouTube Premium. It feels refreshing to be able to pay for a service I enjoy and therefore not be served ads which I don’t enjoy. It seems like a win-win to me. Doing something like this, while technically interestingly, seems like far more trouble than it’s worth for 99.99% of people, especially when there’s a reasonably priced way to block ads that also supports the service.

a12k 2y ago
I paid for YouTube Premium and still got ads, though fewer. So I cancelled. Are they now offering YT Premium ad free?
- neilo40 2y ago
  I haven’t seen a single ad in over a year. You still get paid sponsorships depending on the channel though
- millerm 2y ago
  I’ve been paying for premium, basically because they’ve been sort of forcing to people with the ridiculous number of ads. I get zero ads injected. You’ll still get sponsorships that are part of the video done by the creator, which is now become a little bit more annoying. But at least it’s something that the content creator completely approves of and endorses. I can skip that part anyway. I’ll probably cancel it soon, only because I need to stop watching so much of this stuff, and I need to get rid of things in life that I shouldn’t be paying for. Once I do that, I’ll never be able to watch YouTube again, because it was unbearable with the number of ads injected. I hate being reminded over and over that I am nothing but a consumer that they try to influence with ads over, amd over, and over, and over. Off-topic, I recently got another free month of Amazon prime. I was watching some shows on there, and the ads are f’n annoying there too. I can’t believe they make people pay more now to remove the ads. I’ll never pay for Prime in any fashion.
- voxic11 2y ago
  I have paid for YouTube Premium for years and watch YouTube nearly every day and I have never seen an ad from YouTube (you still may see baked-in ads from the video creator but those can be automatically skipped with the SponsorBlock extension).

metabrew 2y ago

I would love to pay for youtube premium, but i have a google workspace/apps/own-domain/whatever the hell they call it now account, and loads of stuff (like youtube premium) isn't supported.

neilo40 2y ago
I had that issue. I just created a new account solely for YouTube
Havoc 2y ago
Same. It’s wild that Google can’t sort that out
carlosjobim 2y ago
Make another account.

shidoshi 2y ago

Lots of social commentary here, but I'd just note you're one mad lad. This is a great writeup and a nifty bit of sleuthing. I found it enjoyable to read.

Telemakhos 2y ago

There are ads on YouTube? I guess my browser blocks them so well that I didn’t know. The real problem here is that the AppleTV experience is so much worse than an ordinary web browser experience. Apple locked the hardware down to the point that it benefits YouTube’s ad profits more than it benefits the end consumer who pays for it.

focusedone 2y ago
I never see ads on Linux, Windows or Android. Occasionally I try to watch YouTube on an iPad and am shocked at how frequent and irritating the ads are. Same with browsing the web on an iPad outside of the home pi-hole'd network. Howwww do people deal with this every day? The iPad is a work-issued device so I don't often use it for personal things. Every time I do it's a reminder of how irritating it is to do so. It's kindof odd; before being issued an iPad I thought they were only useful as content consumption devices. Turns out it's super handy for quick remote access to work resources but locked to an ad-infested wasteland for general web browsing and streaming media. Who knew?

Terretta 2y ago

This is a novella that just keeps getting twistier, going deeper, and turning out more rewarding. And clearly all these "reasoning" LLMs trained heavily on Eric Draken's refreshingly introspective monologue full of interjections and discoveries.

not_your_mentat 2y ago

Does this work for Amazon Prime as well? I installed AdGuard Home last night and these two have been the only outliers so far.

Havoc 2y ago

Nice to see a writeup that includes the failures too

vincnetas 2y ago

note that GDPR consent section on the site is invalid, it does not have "decline" button. so might as well just get rid of it.

thomasfl 2y ago

For ad free Youtube, go to https://yewtu.be https://yewtu.be or any other Invidious instances https://docs.invidious.io/instances/ https://docs.invidious.io/instances/ There is an arms race between YouTube and Invidious. From time to time Invidious is not working, but the team has always found new ways to circumvent YouTube and deliver the videos without ads.

orliesaurus 2y ago
This wouldn't work on Roku TVs etc since there's no "browser" :(
xela79 2y ago
there's a reason the author included "on AppleTV" in the title. Alternative clients/frontends etc simply don't work
- skyyler 2y ago
  Well, other than this one: https://apps.apple.com/us/app/yattee/id1595136629 https://apps.apple.com/us/app/yattee/id1595136629 https://github.com/yattee/yattee https://github.com/yattee/yattee The UX is not great, though.

greenpizza13 2y ago

Or simply pay for YouTube. They provide a service, it’s not our job as technologists to enable stealing it.

arnath 2y ago
I mean, they provide the service by stealing data from their users. I would argue that this is just as ethically fine as Youtube's entire business model.
DavideNL 2y ago
... if there'd be a healthy amount of alternatives/competitors to chose from, that would probably be true. However, as we all know, it's basically a monopoly.
- carlosjobim 2y ago
  Absolutely! When you discount for cable tv, satellite tv, airborne tv, Netflix, Amazon, HBO, Disney and others. Because we are hackers and everything we don't like (or don't want to pay for) is automatically a "monopoly".

b8 2y ago

Now for someone to figure out blocking FireTV OS

j45 2y ago

YouTube is hard to watch with ads once you’ve watched it without ads for a long time. Neat post to learn about the current way the video stream works. Has anyone else found enough utility in paying for a YouTube premium acct maybe for their entire household vs other streaming services?

deleted 2y ago

[deleted]

Fokamul 2y ago

I've opted to installing opensource youtube app with Adblock and sponsor block. LGTV Webos is so great, there is easy way to become "developer" and it will open official way to install homebrew apps on your own TV. Yeah, since you own it, it can be possible to do what you want with it. Fu** you to all Golden-cage devices like Apple, Samsung, etc.

giancarlostoro 2y ago
I prefer not to use the OS on my TVs and opt for never letting them online, I just hook up my Apple TV to it, this gives me complete control over my TV as things should be.

m3kw9 2y ago

This article is crazy engineering work

RKFADU_UOFCCLEL 2y ago

Why would this be possible without pwning a CA? If so they can just patch it the day after they discover this article. There's no reason to do this anyway when you can just plug a video out from a PC to the TV.

bathtub365 2y ago
A PC isn’t an Apple TV

cryptonector 2y ago

YouTube will detect when you don't stream their ads and will ask you to disable your ad blocker and comment as to what's up.

DrNosferatu 2y ago

…or get an Android TV box and run Tubular ;)

m463 2y ago

why does it say proFobuf? mistake?

aurareturn 2y ago

Hacker News community: I hate ads and I'd rather pay for the service instead of ads. Also Hacker News community: F paying for the service, let's block the ads instead and get the service for free.

nullbio 2y ago

Speaking of Youtube, why does no one ever seem to bring up the fact that they shadow-delete half the comments people leave? It's such a garbage platform, it's a real shame they have no serious competition.

42772827 2y ago
Is it YouTube who does this or the creators who post the content?

ushtaritk421 2y ago

Cool project, but on a practical level it seems like a lot of trouble just to avoid paying for premium

buyucu 2y ago

this is very easy on all non-apple systems just by installing uBlock or newpipe. Why is it so hard on Apple?

Alpha4262 2y ago

[dead]

Gradier5765 2y ago

[dead]