Using VLC to watch an m3u8 playlist at a URL with custom Referrer and User Agent | Hacker News Reader

Using VLC to watch an m3u8 playlist at a URL with custom Referrer and User Agent

gist.github.com

58 pointschatmasta22 comments

I have trouble watching things without subtitles. I dislike most video players on websites since they don't give you the option to search for or manually upload subtitles.

This and other inconveniences motivated me to make a browser extension to fix bad video players on the internet. It works by replacing the video player with a custom one. It also allows me to see what the manifest URL is and what headers it uses so I can copy it over to VLC if I need to.

The extension is available on Github, you can find it here

https://github.com/Andrews54757/FastStream

Nice extension! It would be cool if it could also re-render the page to be _just_ the video player (thus solving the problem in the Gist, with all the ads).

About subtitles: in case an m3u8 stream has them, you can ask VLC to render them with a flag like `--sub-track 0`

Thanks! You can already do that. Open a new tab, and then click the icon to make the player appear. It will fill the whole tab. Then use another tab to find videos on other websites. The new-tab player will automatically collect sources and you can play it by using the sources browser tool. You can then close the tab with the original website.

How does it work? Since sites often have their own craptastic JS player that doesn't embed the source stream in the DOM directly.

Most sites still use a player that fetches a ".m3u8" or ".mpd" manifest file. The extension monitors webRequests and triggers when it sees a request to such a file.

> I have trouble watching things without subtitles.

Having subtitles is very convenient. I don’t have to worry about the volume. I can shift back and forth between listening while being busy with something else or reading them. Also, when it comes to movies, a lot of the time the SFX volume is louder than the people's voices, and unless you want to be that annoying neighbor, you have to keep the remote controller in hand to adjust the volume accordingly.

On AMO I get "Installation aborted because the add-on appears to be corrupt."

https://addons.mozilla.org/en-US/firefox/addon/faststream/

Really? What browser are you using? Is it up to date?

Thanks, that fixed it. I was one version behind.

Another browser extension I've used to handle this exact problem:

https://github.com/54ac/stream-detector

It's archived but I would argue it's feature complete.

This is how I transcribe my local radio stations who have a stream running on their site. I use ffmpeg however and save to 1 minute chunks which I send to whisper.

I am not sure that it is safe to open devtools on a sketchy website. There is a lot of extra attack surface there.

Usually the sketchy websites are the one you open from an ephemeral VM anyway.

Who would open those on their main desktop?

i'd argue any website with a 3rd party ad is a sketchy website. but any site can do it

check out https://github.com/AEPKILL/devtools-detector

Why does opening devtools on any sites is not safe?

What can a website do just from opening dev tools that it can't do without opening them?

it can basically fork bomb the user

The websites I've seen (and was referencing in the Gist) basically do this. But it's a very simple anti-debugger technique that uses an IIFE containing a `while` loop with a `debugger;` statement in every iteration. You can circumvent it by opening DevTools on another website and toggling it to "skip all breakpoints."

I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors. And I'm sure that the attack surface for actual exploits (beyond just DOS) is also greater than browsing a website without DevTools open. But it's not like browser vendors grant super-permissions to websites when the user has DevTools open; any exploit would depend on a high severity vulnerability.

I do agree that it's probably smart to browse sketchy websites in an isolated browser, and ideally one inside a VM.

> I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors.

Just rename debugger to banana.

Edit: I see you have posted it below already!

https://www.nullpt.rs/evading-anti-debugging-techniques

while i agree, 2 things come to mind to assist this: - browsers should have a user-input string for the debug statement that is manually accepted before the debugger runs every time devtools launches (and should be randomly generated each time that devtools is opened) - browser plugins help: check out Netmon (though sadly its yet-another-plugin and js-bloat for the browser to handle)

edit: format i hope

This researcher [0] found the optimal solution was to use a custom build of Firefox with the `debugger` keyword changed to something else :)

[0] https://www.nullpt.rs/evading-anti-debugging-techniques

yes i remember reading something about somebody compiling it to a unique word! wanted to do similar myself (but didnt fall down that rabbit hole yet) - i feel it should be a set-able in the browser (per tab or whatever) - not to sound like a broken record ha

browsers are supposed to be a tool we humans use, not be controlled by

edit: format maybe one day ill get it right

Reply on news.ycombinator.com