Hacker News Reader

Comment by bitwize | Hacker News Reader

There's some obfuscation going on fetching the actual audio and video, the URLs to which are never shown to the user. Those URLs are decoded with a bit of JavaScript. Youtube-dl (and yt-dlp) contain enough of a JavaScript interpreter to evaluate that JavaScript in order to decode the URL.

Since the purpose of the obfuscated URLs and JavaScript is to gate access to the video and audio through a browser hitting the YouTube site where they can't be saved, this scheme constitutes an "effective" copy protection measure. Bypassing this gating mechanism is thus circumvention, illegal under the DMCA.

View on HN

Chrome is a user agent. a program with the ability to take the users request, download a video and then show it.

Firefox is a user agent. a program with the ability to take the users request, download a video and then show it.

youtube-dl is a user agent. a program with the ability to take the users request and download a video

Youtube has no authentication, nothing is being circumvented.

Surprisingly enough, it's even simpler than that. You can trivially access a direct URL that serves the entire video or audio (they're served as different files).

Just open up DevTools, look for requests to googlevideo.com, find the request with the video or audio (i.e. content-type response of either video/mp4 or audio/webm), copy the entire request URL, remove the range parameter entirely, open the link, and voila!

That's the same thing. The only difference is which user agent you run the javascript in.

The lie that Google et al. try to perpetuate is that if your user agent fails to put their interests over yours then it is illegal.

Those URLs are temporary and locked to the IP that fetched them. You can't effectively share the URLs since they're generated uniquely per-client. Not sure if this changes anything though.

edit: some quick testing confirms these URLs are temporary, but they don't appear limited to the IP that generated them. Your IP is embedded in the URL though, and you can't modify it without breaking the URL, so I'm guessing some IP limits kick in at some point.

I have a browser where I can right click on any video and download it locally.

I do not interact with obfuscated URLS, JavaScript, opening any kind of console or dev tools, and no source code.

I save it just as I would save a photo or a pdf.

How is this circumvention? I'm using a feature offered by my browser and using it in a way intended by the creators. The media files are already on my computer (memory or storage, who cares, its been copied already) I am just renaming some metadata like its directory and filename.

This thread is about YouTube. But the videos you mentioned are fine and no one would call right clicking on a video and downloading it a DRM violation.

But I'm quite confident you can't view or download YouTube videos if your browser doesn't run JavaScript. They require the client evaluate intentionally obfuscated JS in order to determine the video content URL's signature. Whether this counts as DRM or not, I don't know, and I hope it doesn't, but it's clear that YouTube is making it difficult intentionally.

Yes, this is a thread about YouTube. Why are we confirming this?

I meant no JavaScript as in me meddling with the js.

Oh apologizes! When you said you don't interact with JavaScript I thought this meant you didn't run JS but I see your point now.

You can right click on YouTube videos to download them? That sounds slick! How did you set this up? Is something YouTube-specific happening or is it generalized and just happens to work on YouTube? That's totally something I'd like.

I have no idea what that means legally, but to me it certainly supports the argument that doing something so simple clearly isn't bypass DRM/violating the DMCA. (though I'm sure the media industry would argue that whatever browser/extension making this possible is guilty of defeating DRM. )

>I have a browser where I can right click on any video and download it locally.

What browser is that?

Not the parent, but most any browser should support this for basic videos. And with JS disabled I think it's only basic videos you'll see.

That is, any <video> HTML element can be right clicked and downloaded, at least in Chrome and Safari where I tested. Interestingly this even works when for `<video controls controlslist="nodownload" ...>` elements where the developer tries to prevent downloading. (in Chrome that removes the download option from the video player's controls, but not from right-click)

Couldn't you claim anything digital is obfuscated since it must be encoded/decoded somehow?

Reply on news.ycombinator.com