Andrews54757
Joined 9 years ago
Karma
304
Submissions
37
Member since
Oct 30
Recent submissions
Comment · 1 year ago
Comment · 1 year ago
Nsig/sig - Special tokens which must be passed to API calls, generated by code in base.js (player code). This is what has broken for yt-dlp and other third party clients. Instead of extracting the code that generates those tokens (eg using regular expressions) like we used to, we now need to run the whole base.js player code to get these tokens because the code is spread out all over the player code.
PoToken - Proof of origin token which Google has lately been enforcing for all clients, or video requests will fail with a 403. On android it uses DroidGuard, for IOS, it uses built in app integrity apis. For the web it requires that you run a snippet of javascript code (the challenge) in the browser to prove that you are not a bot. Previously, you needed an external tool to generate these PoTokens but with the Deno change yt-dlp should be capable of producing these tokens by itself in the near future.
SABR - Server side adaptive bitrate streaming, used alongside Google's UMP protocol to allow the server to have more control over buffering, given data from the client about the current playback position, buffered ranges, and more. This technology is also used to do server-side ad injection. Work is still being done to make 3rd party clients work with this technology (sometimes works, sometimes doesn't).
Nsig/sig extraction example:
- https://github.com/yt-dlp/yt-dlp/blob/4429fd0450a3fbd5e89573...
- https://github.com/yt-dlp/yt-dlp/blob/4429fd0450a3fbd5e89573...
PoToken generation:
- https://github.com/yt-dlp/yt-dlp/wiki/PO-Token-Guide
- https://github.com/LuanRT/BgUtils
SABR:
- https://github.com/LuanRT/googlevideo
EDIT2: Addeded more links to specific code examples/guides
Comment · 2 years ago
In sticking to vanilla HTML/CSS/Javascript for my hobby projects over the past ten years, I've come to enjoy writing "simple" code with minimal dependencies and bare-bones interfaces. I believe that the skills I've learned in doing so has benefited me many times since then, especially during the times when I needed a specific tool, ASAP, for my job as a biomedical researcher. Without having the need to look up documentation, tease apart the workings of frameworks, I've been able to make hyper-specific web based guis for image labeling and more, sometimes quicker and better than the programmers hired for these jobs, who would otherwise need constant communication and supervision to ensure that the correct thing is built.
Comment · 2 years ago
A while back I installed uBlock on my grandparents' computer to help them avoid scammy ads. This change will make it more difficult and dangerous, for elderly users to browse the internet. As a young nerd, I can switch to Firefox easily, but I can't imagine it will be easy for everyone. My experience from using Firefox is that it has its own quirks, and comes with its own learning curve.
I don't know what to say but to encourage everyone to make some noise. Please let your representative know about this. Hopefully we can still put a stop to this before it's too late.
Comment · 2 years ago
I read both. They are both great but I like the original better. The new edition is accessible but I think the original's prose is beautiful.
Comment · 2 years ago
The "get in touch" button on blog.rendley.com leads to a 404 page: https://rendley.com/try-for-free
Comment · 2 years ago
It was pretty straightforward for me to install and use yt-dlp. On a Mac with Homebrew you can do `brew install yt-dlp` to install it in one command. IIRC yt-dlp also provides binaries you can install directly. I'm not sure if installing docker and running a web server is any way easier than that.
However, there are ways to download Youtube videos without installing a native app. For example, it is possible to use a library like Youtube.js [0] to make a browser extension that downloads Youtube videos directly. You won't find those on Google's web store due to policy, but you can find a handful on Github.
Comment · 2 years ago
The moov contains a list of byte offsets which the player can use to directly access media data. You can skip the moofs and other headers inside by using gaps in the offsets.
Comment · 2 years ago
Having worked with some MP4 demuxing for my extension [1], I feel the pain. Lots of times I would play the video only to find inexplicable issues such as drifting audio. I highly recommend using an mp4 inspector tool, such as mp4box [2], to debug these issues.
Comment · 2 years ago
Great article. I've always thought that pessimistic sci-fi dystopias were on the rise, but it turns out most still have positive endings. The observation about walking out of the theatre, and seeing the worst ahead of us is quite interesting.
It would be cool to compare with other, non sci-fi stories. EG: I have been noticing the rise of escapist fantasy narratives in popular media — wish fulfillment stories where a Mary Sue like main character rises above all challenges without struggle. You can see this particularly in light novels, manga, and anime in the now popularized "isekai", "cultivation", or "system progression" genres. It would be interesting to find out how the public's fascination with these types of stories correlate with economic, social, or political undulations in the real world.
Comment · 2 years ago
Requirements as listed by the article:
1. Browser extension has a wildcard pattern for content script.
2. Content script passes postMessage messages to the background script using sendMessage.
3. Background script passes the message to native application using sendNativeMessage.
4. Native application handles the message dangerously, leading to code execution.
Requirement 2 seems to be the most important. postMessage messages should never be passed to sendMessage raw without validation. Fortunately, this should be a rare occurrence in the wild. It only provides very specific benefits to use postMessage in an extension to begin with, and developers who do need to use it are more likely to be aware of the potential vulnerability.
Comment · 2 years ago
Really? What browser are you using? Is it up to date?
Comment · 2 years ago
Most sites still use a player that fetches a ".m3u8" or ".mpd" manifest file. The extension monitors webRequests and triggers when it sees a request to such a file.
Comment · 2 years ago
Thanks! You can already do that. Open a new tab, and then click the icon to make the player appear. It will fill the whole tab. Then use another tab to find videos on other websites. The new-tab player will automatically collect sources and you can play it by using the sources browser tool. You can then close the tab with the original website.
Comment · 2 years ago
I have trouble watching things without subtitles. I dislike most video players on websites since they don't give you the option to search for or manually upload subtitles.
This and other inconveniences motivated me to make a browser extension to fix bad video players on the internet. It works by replacing the video player with a custom one. It also allows me to see what the manifest URL is and what headers it uses so I can copy it over to VLC if I need to.
The extension is available on Github, you can find it here
[1] https://github.com/LuanRT/BgUtils