YouTube video has its own URL in it | Hacker News Reader

YouTube video has its own URL in it

youtube.com

681 pointsignaloidas147 comments

I think it's most likely done with the API. From what I remember from looking at it a while ago you can create the entry before, then it'll give you the right endpoint where you post your actual file to later on in the process. You just have to do that quickly enough so the endpoint doesn't expire.

It's apparently even been done before, see here at around the three minute mark: https://youtube.com/watch?v=UMYTSJTU0Vk

Oh hi, creator of the video here!

It's just a fun video of me messing around with Windows 8.1 I made a while back, trying out different "apps" and stuff. I thought it'd be a fun easter egg to download the video itself when I was trying out that strange YouTube MP3 downloader app :D

I didn't do it with the API (even though I tried to at first), just the normal youtube.com/upload site. I used Fiddler (Burpsuite alternative) to achieve this

I am not the first person to do this however, Insane Doll Gallery has made a video demonstrating this [youtu.be/ufq2Eb78kSU] (apparently used the API) and the channel NightFalls Studios has also used this trick in their My Little Pony comic animations [youtu.be/FDLvR9xrCag and youtu.be/7oXsOmqs6R4]

I always see creators popping up when something they made is mentioned. I find it too coincidental that you just happened to be on HN and happened to find the comment mentioning it. Do you use a service that scrapes sites and pings you of keyword mentions?

Websites can use the "referer" [1] property to show you where visitors are coming from.

[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...

This is true, but for YouTube, the "referer" stats won't appear for a couple of days

I do use a keyword notifier on Reddit (mostly just for my name), but in this case, I just coincidentally noticed the spike of views on my video and put the video url into Google, which led me here

so: https://youtu.be/UMYTSJTU0Vk?t=175

What an odd video!

Definitely not the same technique, but at one point I watched a Mario Maker puzzle level someone had uploaded that used part of its own level code as a clue. The trick was that only two characters of the level code were used, which is hexadecimal, so there are 256 combinations of those two characters, allowing the level creator to brute force re-uploading the level until getting the desired combination.

Reminds me of the brilliant New York Times crossword which "predicted" the winner of the US election in 1996:

http://www.alaricstephen.com/main-featured/2017/7/3/the-clin...

This crossword is available in NYT Crossword app, I just loaded it!

I'm going to try to solve it both ways. :)

This page seems to have zero text or image content unless I let SquareSpace run Javascript (and ostensibly track me).

The crossword ran on election day. The clue for the big across line was something like "headline tomorrow" and the crossing clues worked equally well to match "CLINTON ELECTED" and "BOBDOLE ELECTED". For example the first crossing was "Halloween animal" (CAT/BAT) and so on.

Would your quality of life browsing the web not be infinitely better if you just span up a VM and sat behind a vpn on it?

Um, no. No, I don't think so.

Just running uBlock Origin, the pictures did not load for me either.

I imagine that website is doing something that I wouldn't approve of.

Done more than once before, this one even has an explanation, which matches some of the guesses people already posted I think https://www.youtube.com/watch?v=ufq2Eb78kSU

Excellent, this explains it. The YouTube video you shared says the trick is to create a resumable upload using YouTube API. The steps involved :

1. create a resumable session (here we specify video length in bytes)

2. YouTube returns a session URI which contains the upload ID

3. create a video with the upload ID baked in (edit video to match length from step 1)

4. upload video to the session URI

https://developers.google.com/youtube/v3/guides/using_resuma...

I have not been doing any edits of video for a long time... What are most people editing vids with these days?

As someone who uses Linux, I've found Blender + ffmpeg to be a powerful combo. Almost all of the videos on my channel use those two.

The video sequence editor in Blender is awesome for arranging tracks, audio, transitions, overlays, text, etc. And with ffmpeg you can move it to any format you need. To clean up audio I use Audacity.

Pitivi is great until it starts crashing. Kdenlive is stable but adding texts is painful there. I didn't like Blender video editing much (though I don't remember why anymore).

Blender? Really? Huh, I've been looking for a program to do some simple video editing. Would you happen to know of a good tutorial for the basics of non-linear video editing with Blender?

It takes some getting used to, but once you do it's pretty easy to use.

I have a project file I use as a template with the top right panel set as Video Sequence Editor "Image Preview", the top left for Graph Editor (for transitions curves and stuff), the bottom half of the screen for the Video Sequence Editor for moving around the tracks. Then I just use Add -> Movie/Sound/Image/Effect for all of the actual editing.

When I'm done I switch one of the panels to Properties where I have the render settings configured to use ffmpeg for MP4 output and hit Animate.

I've used Blender for video editing, but I had to pull up a fairly long Youtube video on how to set up my environment and choose settings in Blender's UI.

I've just pulled down a 2.80 release candidate with the UI overhaul to see if it's any better. It's actually pretty nice. I just selected the video editor option in the startup screen, and things sort of worked like I expect in a NLE.

Oh huh, maybe I'll just get that then, thanks!

The Mike Meyers[1] youtube tutorials are great. He will do 2.8 based tutorials soon.

[1] https://www.youtube.com/user/MikeycalDOTcom/playlist

This seems very helpful, thanks!

Does Blender allow previewing the sound in videos yet?

I like https://shotcutapp.com/... It's free and open source, has good Linux support and all the features I need, and uses ffmpeg under the hood.

On Windows I'm using DaVinci Resolve. It's closed source but free, and professional quality.

I'm using kdenlive in linux, works great for my use. I know others are using blender too but I prefer the kdenlive UI.

Same, but I'm looking forward to trying the new Blender UI.

The one I'm familiar with is ffmpeg, a free, programmatic tool for simple to advanced use cases: https://ffmpeg.org/

The free version of Hit Film is really excellent: https://fxhome.com/hitfilm-express

Good to put some VFX.

Aw, I was excited until I realized there's no Linux version :(

I must confess that it was one of the reasons that I left Linux. The other was parental control.

DaVinci Resolve.

Also available for GNU/Linux: https://www.blackmagicdesign.com/products/davinciresolve/

Most professionals use Adobe Premiere (+ Audition/After Effects), Final Cut Pro, DaVinci Resolve or Vegas Pro, some use Blender and Kdenlive is great for smaller and simpler edits and works on Linux

I used shotcut last year, even if it was a little crash-prone on windows 10.

C.f. this tweet, which has a link to itself: https://twitter.com/mauritscorneIis/status/99142460340155187...

(And as we all know Twitter has no edit button, no post-upload shenanigans are possible here, just some clever guessing and reverse-engineering Twitter's ID generation algorithm)

There's a decent write-up of how to do this here: https://www.spinellis.gr/blog/20090805/

As you said, it largely relies on reverse engineering and bruteforcing Twitter's ID generation.

Bot author here. That post was before twitter made changes on the id generation. Now it consists of four parts that you need to guess (the datacenterId, the workerId, a sequence and a timestamp). For more details, the bot repo is here: https://github.com/pomber/escher-bot

This tweet (or one like it) caused a massive Twitter outage.

Yeah, "If you type 'google' into google.. you can breakthe internet, so please no one try it" IT Crowd /s

Nothing like finding a loop in a simple graph...

Citation?

Used to work there :D

Was it because Twitter tried to recursively load the previews?

Was there a post-mortem about it?

Is that because some algorithm assumed link cycles weren't possible?

Interestingly, there's a frame or two at the very beginning that shows a document open that could suggest an exploit of some kind.

Screenshot: https://i.imgur.com/3oTXTDK.png

From: Pi

To: Pi

Subject: Project Time Machine - Test #3

It sounds like someone's trying to create some fun meta-fiction - it looks like a letter from the creator's future self to his past-self, describing future-self's experience going through some iteration of the time-loop ("Don't talk about fate. You did it once and it was cringy.")

Indeed - using the Czech-language version of Word and email client.

I believe that’s just part of the joke. It’s a mock email from the future, telling him what the URL will be and how to make the video.

In another comment, someone says the trick here is to do a resumable upload.

The document is covering the sign at the start of the video, so the uploader could have uploaded that section (without any text on the sign in-game), then "resumed" the upload with a different video that contains the URL on the sign and starts after he switches to the Minecraft window.

Except that the email at the beginning has the URL in it

Those look like "show notes" for the video creator to cover/notes to themselves.

Reminds me of the gif showing its own hash https://news.ycombinator.com/item?id=13823704

A somewhat related story about why text posts on reddit are called "self posts" (copy-pasted from a thread from 5 years ago where someone asked why, linked near the top of the explanation):

---

It's actually a bit of a long story, but it's kind of an interesting part of reddit's history. Some of my details are probably off, but this is how I understand it.

A long, long time ago, reddit only supported submitting links. Link submissions were pretty much exactly the same as they still are now, including having a comments page that you could go to with an address like the page we're currently on: http://www.reddit.com/r/help/comments/2bmy3l/what_does_the_s...

If you look at that address, one thing to notice is that it includes the submission's ID in base-36, which for this post is "2bmy3l". If you go to http://www.reddit.com/r/all/new and look at the links to the comments pages of the newest posts, you'll notice that their IDs are increasing. For example, at the time I'm writing this, the newest IDs are 2bo3uw, 2bo3ux, 2bo3uy.

Since the IDs are increasing, you can predict which ones are coming up. You know that the next ID after those ones should be 2bo3uz. So some person decided it would be funny if they pre-constructed a link like this: http://www.reddit.com/r/reddit.com/comments/<id>/this_post_w... and then checked which IDs were coming up, filled in the "<id>" spot with one that should be used soon, and submitted it.

If they got their timing right, they'd end up with a link post that actually went nowhere. Clicking it would just take you to its own comments page, since they had managed to predict the url that the comments page would have. This was a "self post", a post that linked to itself.

So this was a pretty neat trick, and when it was successfully pulled off for the first time, it got a whole bunch of attention. Unfortunately, reddit's never been very good at just seeing some new popular thing as a novelty and moving on. No, of course pretty much everybody wanted to get their own "self post". The majority of the new submissions to the site were suddenly just people trying to make a self post, completely drowning out all the real submissions.

It was causing a gigantic mess, so one of the admins at the time decided to get people to stop by taking all the fun out of the game. They made it so that you could just choose to make a self post. You didn't have to guess the ID or anything, you just selected that you wanted to make a self post and automatically got one. It didn't have the option to add additional text or anything yet (that came later), it was just a title that linked to its own comments page.

So that's how self posts came about, and where the name originated. A quick solution to a mess being made by users that eventually turned into one of the most important pieces of reddit.

Vaguely related: I noticed that the old reddit UI would display self posts as "self.subredditname" and link posts to foo.com as "foo.com". I realized there was a potential confusion if your tld is the subreddit name, and the 2nd and only other label is "self". So I registered self.finance and posted a link to it to /r/finance .

https://www.reddit.com/r/finance/comments/3ancv0/selffinance...

Oh man, I remember trying (and succeeding) to do this with comments, back before you had a 30 second grace period before getting the asterisk. I wrote a comment that linked to itself.

I later became "more" famous for inadvertently DDoSing reddit, and forgot all about it until someone replied to one of my comments saying "aren't you the asshole who brought down reddit as an April fool's joke?". "Huh? No! Oh, wait".

How?

I created the f7u12 subreddit, so I thought it would be funny if I put the "reddit is down" graphic over the subreddit front page with CSS.

It had millions of subscribers. They all kept refreshing.

Lol, that's good. Also le f7u12, haven't thought about that in years .. I guess you brought rageguy over from 4chan then?

It had already spread by then, I just created the subreddit and it took off.

> Unfortunately, reddit's never been very good at just seeing some new popular thing as a novelty and moving on.

So very reddit.

Do you know what year that was?

January 22, 2008 is when the built-in feature to make self-posts was added: https://www.reddit.com/r/bugs/comments/666ne/testing_self/

I guess this could be referred to as a YouTube quine (as opposed to a YouTube queen.) It'd be even more amusing if the video ID contained something meaningful --- I've seen that happen by coincidence.

For some users, at least for me, it is actually possible to just replace the video file in the upload interface on YouTubes website, within the first hour or so. Using this method this would be easy.

Maybe 1) start upload till URL appears 2) go offline 3) replace file 4) go online

You're right, I did what you said and it works. This is easier than I expected.

https://www.youtube.com/watch?v=bF37GjdwJvk

Nice, was a lucky guess!

Or:

1) Make an educated guess about what the URL will be and put it in the video.

2) Upload.

3) If you were wrong, delete it and go to 1).

I'm half joking, but that's basically what they did for a git utility that would let you edit histories so that messages could refer (by partial hash) to later commits. I forget the name, though, and couldn't find it on a quick search.

how long until you get the video id ? if you generate a lazy stream of images you can ~self reference

Another way to achieve this would be to make a video which flashes each possible digit of the YouTube video ID alphabet once for each digit, then use YouTube's video editor to cut out all the incorrect digits.

The video, running at 60fps, would have to be 38996161157 years long for this to be a possibility Even if you predicted the first 3 symbols of the id, you'd still need a 148758 years long video

each possible digit, not each possible ID.

You seem to be calculating some combinatorial explosion, where there probably is none

You need to flash each possible ID, as the YouTube video editor only allows for trimming

No, YouTube lets you cut out parts of a video retroactively. “Video editor” might be the wrong name.

What?

38 frames * 8 (or however many possible characters there are.

What?

It's 62^11 * 0.016 (seconds). 11 because 11-character-long id; 62 because 62 possible characters in each location (26 lowercase, 26 uppercase, 10 numerals); 16ms in each frame of a 60fps video.

That doesn’t seem to be what is being suggested.

   for idIndex in 0..<11 {
    for character in setOfPossible {
     draw(character)
     frame += 1
    }
   }

I calculated mine by doing 64^11/60/60/60/24/365

YouTube uses base64 for the URLs, which makes 64 different characters

I divided it by 60 frames, 60 seconds, 60 minutes, 24 hours and 365 days

It would be more useful if Google / Youtube's API allowed 'reserving a slot' which would create a video ID endpoint but not finalize the content. Accounts might have a per-account limit of some small number of floating slots which would also timeout after a day or two.

This wouldn't violate the write-once model since the submission wouldn't be completed, it'd just defer finalizing and publishing it for a little.

More useful for what application? Other than a novelty, why would anyone need a reserved spot?

Some workflows around video production might find it useful to have the actual YouTube URL early in the process.

To provide a link to next week's video/ the next of a series inside the previous?

URL shorteners do this trick, can just update the redirect. Most people just put videos in a playlist so it comes recommended next though.

And end cards were made for exactly this purpose - you can't put them in the description but at the end you can link to latest video in a playlist.

Video descriptions can be edited.

This looks really interesting. Has YouTube ever published their URL generation technique?

Any one has a guess how this was done? If they use a one way hash over metadata and content if video does this not mean that someone has figured out their secret key.

As far as I was aware, the ID is just a hashed version of the actual database id being passed through an algorithm using base64. hashids[0] implements a similar method of obfuscating IDs.

0: https://hashids.org/

You can also permute your ID space using a block cipher.

I'm wondering how this could actually be exploited. Is there any value in knowing your URL ahead of time besides impressing the HN crowd?

you can post links all around the web and do some kind of SEO-bomb for the video if you can guess the URL before hand, but that quickly happens organically for popular/viral stuff anyway

This reminds me of the holy Grail (for me anyway) of a file containing its own hash

What do you know, this has been posted in another comment in the thread: https://news.ycombinator.com/item?id=13823704

It's not that difficult to do if you use a weak hash (eg crc32) and bruteforce it.

Also you could pad the file with some extra data, but that feels like cheating.

How about a comment containing it's own item ID ...? 20456050

Actually, quantum mechanics allows this

You know you can edit previously uploaded videos,right? https://spencerdailey.com/2019/06/24/youtube-should-give-use...

Ok now give me a text file (or some kind of image file) that contains its own md5/sha1/sha256 hash in the text (or in the image)

  It's a PDF, a ZIP, and an HTML page:
  If you drop it on itself in a browser,
  it can give you a PDF viewer, a video
  and a PNG explaining the whole file structure.
  All these files have the same MD5.

https://twitter.com/angealbertini/status/1111329484647616513

The explanation for how the MD5 trick is achieved is in the PDF, starting on page 21.

Edit: whoops, probably more relevant is this earlier issue, which has the MD5 printed on the cover. https://github.com/angea/pocorgtfo/blob/master/contents/issu... The relevant article in that issue starts on page 46.

https://shells.aachen.ccc.de/~spq/md5.gif

https://news.ycombinator.com/item?id=13823704

Can we add "[video]" to this title?

https://twitter.com/selfrefer/status/3128391843 is a self referencing tweet and more impressive (since there’s no api to “cheat”).

Can't you just upload a video, get the url. Make a new video and upload it as an edit?

No, you can edit a video in YT but you can't reupload a new video with the same URL.

I am very sure that high profile users can do that.

edit: Yes, sorry for the crappy source though -> https://www.reviewjournal.com/insidetech/youtube-lets-some-u...

So reupload a new video as an edit?

Anybody knows how?

Just a guess but I assume this was done by starting an upload with the API which gave the guy the ID but then not streaming the actual video file until it was recorded. Looking at an example of the API in use ( https://developers.google.com/youtube/v3/docs/videos/insert#... ) that certainly seems plausible although I would imagine that there would be a timeout making it difficult.

edit: after looking at the other guy mentioning the time machine reference, my theory would be that he just spammed this API until he got a plausible URL and only then recorded and uploaded the video, probably would take a while but not forever considering how loose the URL actually is to delorean

The ID returns once your upload is completed.

Edit: I don't know the answer but I assume from all the APIs I worked with in the past, but if you get the URL before the upload is completed then yeah it's pretty easy to "fake".

Maybe with this API, but when uploading a YouTube video through YouTube, you definitely get the URL before the actual upload finishes. I don't imagine it'd be terribly hard to reverse-engineer that API.

My guess is that you can start an upload, get the ID, and then stream unimportant and non-comitall video headers and chunks (e.g. subtitle tracks or other metadata) slowly enough to keep the server from closing the connection on you. Then you can just record your video and start uploading actual video chunks once ready.

Or maybe YouTube doesn't have a huge timeout for starting your upload, so you don't even have to do all of that.

Not for me. When I'm uploading a video even when it's at 0% I see "The URL of your uploaded video will be: blah"

So it seems you can get the URL immediately... maybe then stop the upload mess with the video and then resume the upload... but I assume the resume feature takes a hash or something to make sure it's the same file..

Yes, I thought I saw this too many years ago when I was making youtube videos, and uploading would be slow or broken. Although I never tried changing the video after getting the URL.

Have you confirmed this? In the example the ID is retrieved from the finished upload response, but on the actual YouTube website does tell you the video link with the ID in advance, and the API parameter 'part' does appear to allow you to get the ID.

Presumably that is not always the case, though. What about live video, for example?

Start uploading a video, pause the upload, you could already get the ID of the vid, render rest of the video and then continue the upload that now contains the ID of the video :D

This is probably it, I'm going to say Bingo.

How to pause? and re upload pending part with new video?

Here's a guess: upload from a browser running on Linux, and create a FUSE filesystem that blocks read() calls until you've generated the video.

I tried it with a named pipe ("mknod /tmp/foo.mp4 p") and it gave me an error, but before the error, the web page blocked during upload, but it showed me the URL that will be used (before I gave it a single byte of data).

I'm not sure you could do this in the website itself but this would be trivial using the YouTube APIs.

And then cut away the beginning.

My first guess is that new versions of videos can be uploaded if they're similar enough (not sure how it would judge that? visually???) and/or are updated shortly enough after upload.

Edit: Oh, I didn't even see the time travel reference in the ID. Maybe the ID is generated from metadata, and there's some endpoint where he was able to throw random metadata at it in an automated process until it came out looking somewhat like "delorean". Or he was able to get ahold of the algorithm locally for a quicker version of that process. In any case, I doubt he backwards-engineered anything.

Wasn't there some discussion of Youtube allowing videos to be modified recently?

Could you start uploading a file then append the video you create before the upload process completes?

https://developers.google.com/youtube/v3/guides/using_resuma...

Live streaming your live stream

Wouldn't it say streamed instead of published then in the description box?

Somewhat in the same vein: http://madeofmistake.com/selfrefdata

Clever way to do it :) And the frames at the start are there, because his solution needed time to get the ID in order to dynamically show it inside Minecraft.

my guess is the url is a hash of the video upload time, username , video length (is deterministic) so he uploaded 100 (or 1000) and kept the one that worked

tip: if you see something magic it's usually just dilligence in disguise. (like the Prestige)

The video shows a '0' but the url has an 'O'

I thought, '0' (zero) is filled/dashed in that font to distinguish it from 'O'. Or you're trolling. ;-)

If the video was reading the actual url in real time, then, if I add another query string parameter it should show up on the video. Which is not the case. So I assume it was somehow edited.

i thought this was going to be an infinity mirror. oh well

Reminds me of the guy that posted this:

https://news.ycombinator.com/item?id=20456139

I thought you were going to link to this thread [0] on HN, which would upvote itself if you clicked on it.

https://news.ycombinator.com/item?id=3742902

Okay, how did you do it?

Post first half, then edit? Just a guess.

Let's see if that works.

Yep! https://news.ycombinator.com/item?id=20457180

My actual technique:

- post first half

- fumble around trying to find the link