No requirements for me. I don´t use YT at all :) There are plenty of better alternatives.

And how do you watch content on dailymotion and vimeo when the content creators only post them on YouTube?

Why are they using the web target? YouTube has multiple other attack vectors which have no javascript barriers.

Plenty of devices have YouTube players which are not being capable of being updated and which must work, exploit those APIs.

The whole point of YouTube (now) is it’s a market for human attention and behavior. Eyeballs, engagements, tracking and analytics. They will go to great lengths to protect and increase the value of this market.

I would be really interested in hearing what Mike Hearn has to say about this. AFAIK he was responsible for something very similar that was used at Google for other products that had some overlap.

That seems a lot of dev work, why not just run in browser then? There are extensions that work pretty well, like Tubly downloader, Video DownloadHelper.

This morning youtube was already breaking the functionality of yt-dlp.

To solve, just upgrade on linux using:

pip install -U "yt-dlp[default]"

I refuse to run JS on my n270 netbook; even less with a propietary license. Thus, I will just use some invidious mirror.

> Up until now, yt-dlp has been able to use its built-in JavaScript "interpreter" [1]

Wow, this is equal parts fascinating and horrifying.

Edit, after looking into it a bit: It seems like a self-contained build of deno weighs in at around 40 MB (why?), so I can see why they tried to avoid that and appreciate the effort.

[1] https://github.com/yt-dlp/yt-dlp/blob/2025.09.23/yt_dlp/jsin...

At this rate they are just gonna have to ship a whole web browser with it lol.

Youtube is the real monopoly. Creators are also slaves, as they cant monetize elsewhere, and also they cant let their users download their own content. And the icing on the cake is youtube is unbearable without an ad-blocker, and even with that youtube has started throttling ad-block users.

Its such a shithole, with no real replacement, sad state of affairs.

Youtube is victim of its success

I don't promote piracy, but it seems that it's easier to download music from youtube than using torrents, which is quite surprising.

Who expected that such a big company would contribute to piracy?

Honestly the time is now to start building a P2P mirror on top of yt-dlp so the videos only need to be scraped a few times, within 4 years it's obvious ads will be burned into the video file or yt-dlp will no longer function at all and then it will be too late to mirror YouTube and the content will be locked up and eventually lost.

Is there an official name for this endless uphill battle? Counter-Enshittification?

amazing how posts critical of google quickly fall off the front page during north american hours

I wonder if they could use Wasmer to execute Javascript under the hood without limitations.

I did download YouTube videos a few years ago, I did value that YouTube could keep your place.

But it’s a real mess it keeps crashing, something I might too humbly put down to me having too many files, but passive aggressively put it down to YouTube on iPad not having a limited amount of storage space.

On the other hand there’s a number of amazing videos I’ve downloaded to watch which have been remotely wiped. Grrr

Viva Revanced!

SABR

more dependency bloat just to deobfuscate some randomly generated bs that's increasingly complex for no reason and has no value existing in the first place, much like its creators

...

none of it will matter soon. anything you want to see or watch will be dynamically generated just for you. enders game is here.

Good to see the mice are still winning the cat-and-mouse game. Selfishly, I kind of want the cat to start to win, to satisfy my curiosity. I predict that if YouTube ever actually blocked downloading, a YouTube competitor that supports downloading would start to immediately gain popularity. I want to know if I'm right about that, and there's no way to test unless Google actually starts to win. Go, Google, go! I believe in you!

A friend of mine recorded a YouTube video using OBS. She had to do some minor edits on it and could not use her system during the recording, but it worked. I told her to stop it, as that is infringing on the creator's copyright and is an assault on the nation's digital economy. She hasn't recorded a video since, at least not that I know about. I feel good about making sure YouTube can reasonably profit off of creators' content since they give away the storage and access for free.

And if the audiences got larger on a site, governments around the world would decide together to drag them into court and keep them there until they closed down or sold to Ellison's kid.

So they're not paying YouTube but get free advertising for their product from it, which brings in 100x more users that elsewhere? Seems like an OK deal.

Youtube’s tv app is actually just a website (youtube.com/tv, although you need a tv user agent). So yeah, I think most tvs are using JavaScript and the rest are using the tvlite api which has less formats than web_safari (which will continue to work in yt-dlp without Deno if you’re willing to accept 1080p downloads with inferior codecs)

They have been using the older APIs kept around for the benefit of those smart TVs for a very long time, but things move on and newer TVs get fancier hardware and more full-featured software, which includes YouTube, and so Google has started proactively dropping support.

Sorry, I saw the submission (no votes and aging), upvoted it and left the comment thinking the post would die. But someone thankfully did what I should have.

Came across this the other day - set of yt-dlp helper scripts loaded up with flags:

https://github.com/TheFrenchGhosty/TheFrenchGhostys-Ultimate...

That's why youtube is so buggy and slow.

So, instead of using something lightweight and embeddable like QuickJS, they opted for Deno? Nothing specifically against it, just seems... overkill

Really feels like the somewhat open nature of yt is running on borrowed time

I started this fight with youtube back when it was called google video, because i wanted to watch content but my 28.8kbps modem didnt have the grunt todo it in one session.

When i started getting 100,000's of downloads a day, google updated their html and blocked me from their search engine. I did the cat and mouse a few times but in the end it wasnt worth it.

Glad to see the legacy still lives on :D

https://gvdownloader.sourceforge.net/

Surprisingly, Deno was chosen as the first JavaScript runtime due to its security features. I thought it was almost dead, as Bun is growing very quickly among developers.

Fortunately the community is not alone in this fight, because many AI companies need to be able to download YT videos. But they should sponsor yt-dlp more directly..

I wonder if we're going to see JS runtime fingerprinting attempt from google now

I wonder if the youtube phone app also needs a JS runtime or is it able to bypass the JS requirements somehow.

NewPipe will probably need to add a JS runtime too.

The folks at deno have really done a fantastic job at pushing a JS runtime forward in a way that's more easily plug and play for the community. I've used `denoland/deno_core` and `denoland/rusty_v8` quite a bit in embedded projects where I need full JS support but I can't assume users have node/bun/etc installed locally.

Not surprised to see yt-dlp make a similar choice.

I would pay for YouTube if Google created the best possible search engine they could for it. I'm talking inverted and semantic indexing of every word of every video with speaker tagging and second level timestamping. I want to be able to runs queries like "Give me the timestamps of every time Veritasium said math while wearing a blue shirt."

> Note that installing Deno is probably not necessary if you don't want to, only downloading it. Just like yt-dlp, Deno is available as a fully self-contained single executable from their GitHub releases: https://github.com/denoland/deno/releases.

> Yeah, you can just extract the zip and put deno.exe in the same folder as yt-dlp

I hope they just make this automatic if this truly becomes necessary. yt-dlp not having requirements, or having them built-in, isn't something just "convenient", I think there's users that wouldn't use the tool without that simplicity. Most people really don't like and try to avoid having to fight dependencies.

What I found much more annoying, and so far have not been able to work around, is that yt-dlp requires you to have a YouTube account, something that I have not had for a decade or so, and am unwilling to create again.

What tool can I use to simply store what my browser receives anyway, in a single video file?

How will this JS execution be contained/isolated? Do we have to run it inside a VM, or containers?

What are folks thoughts on jdownloader2 these days? Hell is that still kicking?

Great ad for deno. I hit a similar one the other day from pydantic. They make a MCP server for running sandboxed python code and the they did that… Python to WASM, and wasm running in deno.

It's incredible how much work goes into these open source projects for downloading youtube videos, especially since youtube keeps breaking them. There are nearly 1500 contributors

Why won’t they use my browser for downloads, for example through TestCafe? That would also allow downloading premium quality (for subscribers) and so on.

I've been using yt-dlp to download transcripts. Are there alternatives that don't require going through all these hoops? I'm guessing no.

I was scared this morning when yt-dlp did not work, but a git pull fixed it.

A huge thank you to the yt-dlp folks. They do amazing work.

This change has been long overdue. The web player has been broken with yt-dlp for such a long time.

Will Debian package Deno for it?

Looks like this runtime is written in Rust. Really does seem like Rust is rapidly swallowing all kinds of common tools and libraries. In this case a single compiled binary for multiple architectures is quite convenient for something like yt-dlp.

Might as well start an effort to rewrite the whole project in Javascript at this point

Hmm, like bun? Are there many others?

And you're welcome to implement them and submit them as a PR.

The yt-dlp contributors are not in the business of writing or finding JS runtimes, they're trying to download videos.

It's a VPN thing, or a 'you've been downloading too much and are ratelimiting you' thing.

I can confirm this. I guess they didn't like me using Invidious.

I personally wouldn't want to hire a startup employee who couldn't figure out how to install a browser extension. ;-)

The sandboxing features of Deno also seem to have played a role in that choice. I wouldn't overly trust that as a security layer but it's better than nothing.

Keep in mind that yt-dlp doesn't just support YouTube, which-- notwithstanding the claims of "all DRM is malware" etc.-- probably won't download actively harmful code to your computer: it also supports a huge number of video streaming sites, including some fairly obscure and sketchy ones. Sandboxing in the interpreter that's at least as good as what you'd get in a browser is a must, because by design this is doing untrusted code execution.

When it was just YouTube Vanced they got DMCA'd for redistributing "stolen software"

So instead of "stolen software" they distribute "patches" and a patching framework.

Legally distinct and modding is a much grayer area.

It's code you run locally to company the file, change the bytecode and repack it.

I haven't used it myself, but my understanding was that revanced was patching the offical youtube app, while the other two are from scratch reimplementations. You wouldn't be allowed to distribute the full version of revanced, you can only distribute the patch.

Because no matter how much the YouTube app may suck in various ways, it's still vastly better than NewPipe and LibreTube in UX and much more enjoyable to use. So I'd rather use a patched version where the bad parts are removed over something like NewPipe which is just nowhere as polished.

If it works like Youtube TV you are given the option to switch household locations when you get the nag screen.

They probably have metrics they track, such as purchases or customer activity.

> how Google built their empire. Who knows

By scraping every page and directing the traffic back to the site owners. That was how Google built their empire.

Are they abusing the empire's power now? In multiple ways, such as the AI overview stuff. But don't pretend that crawling Youtube and training video generation models is the same as what Google (once) brought to the internet. And it's ridiculous to expect Youtube to make it easy for crawlers.

Ironically a very large chunk of youtube creators themselves need the ability to download real files so they can use segments in their own videos.

TikTok is very strange in that it actually does let you download real files.

I’m using Brave, but didn’t know either :p

The state of the art is to remote-control a real browser now. Defeats all not-a-real-browser checks. You can even click on the cloudflare captchas.

JS interpreter doesn't have the access at all - it is provided by native functions, added by the wrapper like deno, so there is nothing to block.

It's silly from an engineering perspective, but unfortunately clever from YT's perspective of "how do we complicate this as much as possible".

Thanks for explaining - I didn't understand that this is what was being replaced.

The pitch is for the employer: This would likely be both cheaper and simultaneously stickier.

Bytecode interpreters are quite simple compared to the actual lexer / parser.

They can afford it because the market rightfully bets on such trained models being more useful than upstream sources.

In fact, at this point in time (it won't last), one of the most useful applications of LLMs is to have them deal with all the user-hostile crap that's bulk of the web today, so you don't have to suffer through it yourself. It's also the easiest way to get any kind of software interoperability at the moment (this will definitely not last long).

It's classic frog boiling. I want them (for whatever definition of "them") to just nuke the frog from orbit.

> modern browser scripting is extremely easy, so you can often scrape things with mild single-person effort even if the site is an SPA with tons of dynamic JS.

I think he means the JS part is now easy to run and scrape compared to the transition time from basic download scraping to JS execution/headless browser scraping. It is more complex but the tools haven’t been as evolved as they are now a couple of years ago.

mozilla-unified/dom/base/Navigator.cpp - find Navigator::Webdriver and make it always return false, then recompile.

+1

I made a web scraper in Perl a few years ago. It no longer works because I need a headless browser now or whatever it is called these days.

Web scraping is MUCH WORSE TODAY[1].

[1] I am not yelling, just emphasizing. :)

When I try it for a month, the worst part.. your entire download queue fails forever unless you manually remove hundreds of items one by one

There is no way to remove the stuck item if it's been pull from streaming library or you in country that -- such traveling etc -- does not have r ights to it. You simply cannot open the track to undownload it

One thing I like about Tidal though: you can download everything, DRM-free, using tidal-ng.

But with TIDAL I cut them some slack because they're not a multibillion dollar behemoth.

I do wish they'd improve their CarPlay search results though. I hate asking for a well known song and getting some obscure EDM remix.

Doesn’t solve VLCs suckiness on iOS. No PiP support when it’s been in iOS for years now…

i use this for things i repost on IG with commentary. i would rather not have a huge folder of downloads of random stuff i'm not even sure i want to revisit. (and i'm bad about clearing out space on my phone.)

Nice trick I'll have to try this. Thanks!

What shell app do you use?

> The Internet was turned into a slop warehouse well before LLMs became a thing

I suppose that's thanks to Google and their search algos favoring ad-ridden SEO spam. LLMs are indeed more appealing and convenient. But I fear that legitimate websites (ad-supported or otherwise) that actually provide useful information will be on the decline. Let's just hope then that updated information will find its way into LLMs when such websites are gone.

1. Zero

2. N/A, but enough content creators on YT are very much aware of the kind of prison it is, especially in the years after the Adpocalypse.

3. Obviously, nobody should be able to monetize the copying of content. If it is released, it is publicly released. But they can use LibrePay/Patreon/Buy me a coffee, they can sell merch or signed copies of things, they can do live appearances, etc.

Do you have any plans for the target to be S3 compatible in addition to a posix file system? If I wanted to sync a YouTube channel to a Backblaze B2 bucket or Minio, for example.

the control changes sound like you might have gotten caught in some kind of a-b testing

That's why I'm not using Google accounts for anything important, I left gmail in 2014 and I really advise everybody to do the same.

You never know when the hammer can drop.

> This is exactly why Google is clamping down on running your own choice of apps on Android, as well as pushing things like remote attestation on both phones and browsers.

Yes, Google is doing this; but I don't believe Google is doing it to squeeze an inconsequentially small boost in YT Premium subscriptions from former-account-sharers - I believe they're doing it because they want to demonstrate that YouTube is a "secure" platform for large, Hollywood-like, production studios to feel comfortable publishing first-runs of new TV content directly to YouTube - and those production companies are famously paranoid, luddite, and comically ignorant of cryptography fundamentals (i.e. they believe DRM can simultaneously allow legal subscriber Alice but deny evil pirate Bob from watching protected content when Alice and Bob are in-reality the same person (it's you, me, us!).

..and if not Hollywood studios, then certainly the major sports leagues. [The NFL's lawyers seem like real fun at parties](https://publicknowledge.org/the-nfl-wants-you-to-think-these...).

They will probably start requiring SecureBoot as well. So at some point running Linux will also pose a problem. It's not impossible but the extra steps are a pain in the butt.

DRM is added at the last hop before the content is sent to the client. It has to be, because the key is different per client.

What are your thoughts on the load scrapers are putting on website operators?

> It would be a good compromise if I could have such an engine which I could build with a simple C compiler. You have modern javascript engines implemented in C, but no web engine

I'm merely telling you that you can do exactly that.

> The future will just be every web session gets tied to a real ID

This seems like an awful future. We already had this in form of limited ipv4 addresses wher each IP is basically an identity. People started buying up ip addresses and selling them as proxies. So any other form of ID would suffer the same fate unless enforced at government level.

Worst case scenario we have 10,000 people sitting in front of the screens clicking page links because hiring someone to use their "government id" to mindlessly browse the web is the only way to get data of the public web. That's not the future we should want.

I definitely agree logins will be required for many more sites, but how would the site be able to distinguish humans from bots controlling the browser? Captcha is almost obsolete. ARC AGI is too cumbersome for verifying every time.

Deno is a V8 wrapper, the same JS engine as Chrome. Vulnerabilities are very common there, not necessarily because it's poorly designed but more because there's massive financial incentives in findings them.

This plus what you mentioned is why I would never trust it to run arbitrary code.

Now in the context of yt-dlp it might fine, google isn't going to target them with exploits. I would still prefer if they didn't continue to propagate "DeNo iS SaFe BeCauSe It HaS sAnDbOxInG" because I've seen projets that were actually executing arbitrary JS rely on it thinking it was safe.

Well, you're welcome to create one if you have the money for it and the appetite for getting your home raided by the FBI because some moron used your service to promote terrorism or CSAM.

Youtube can get away with its shit service and utter lack of sensible moderation simply by being under Google's roof and the effort required to start up a competitor.

Scraping was a thing before LLMs, there's a whole separate arms race around this for regular competition and "industrial espionage" reasons. I'm not really sure why model training would become a noticeable fraction of scrapping activity - there's only few players on the planet that can afford to train decent LLMs in the first place, and they're not going to re-scrape the content they already have ad infinitum.

P2P services proved a long ago that hosting is not a problem. Politics is a problem.

What we don't see is more web video services and services that successfully trick varied content creators to upload regularly to their platform.

https://en.wikipedia.org/wiki/PeerTube also must be mentioned here.

And by "not many" you really mean zero competitors.

(before you ask: Vimeo is getting sold to an enshitification company)

It's DRM-ed and somewhat broken.

i'd argue that 95%+ of users (creators and viewers) couldn't care less about downloading videos. creators use youtube because it's where the viewers and money are, viewers use youtube because it's where all the content is. none of them are going to jump ship if yt-dlp dies.

also, one could assume that the remaining 5% are either watching with vlc/mpv/etc or running an adblocker. so it's not like google is going to lose ad revenue by breaking downloaders like yt-dlp. grandparent comment (legacy smart TV support) is the much more likely explanation

None of that was mentioned in the comment?

Don’t worry!

Ads are coming to AI. The big AI push next will be context, your context all the time. Your phone will “help” and get all your data to OpenAI…

“It looks like you went for a run today? Good job, you deserve a treat! Studies show a little ice cream after a long run is effectively free calories! It just so happens the nearest Dairy Queen is running a promotion just for the next 30 minutes. I’m getting you directions now.”

I think your point is valid, but FTR the "shift" happened long before ChatGPT; bot traffic has exceeded that of humans for over a decade.

yeah there are alternatives for sure, but it takes time to discover them. But many search engine are offering searching of videos. So may just be a good idea to start building a public index of all the videos.

And it is 2025, the HN crowd here can usually just deploy their video to CDN. Many business are also just hosting their own videos.

BTW forgot to mention Odyssey underlying protocol is https://lbry.com

And seems like there are past article about it on HN: https://news.ycombinator.com/item?id=24594663

YouTube get 700,000 hours of video uploaded every day. That's 4.3 PB added per day. You may need more than a few dozen TB... https://www.reddit.com/r/AskProgramming/comments/vueyb9/how_...

Yes, of course. I agree 100% that the designed-to-be-ewaste market is terrible. If I had my way, any manufacturer-privileging signing scheme would be illegal. So would the anticompetitive bundling of software with hardware devices, for that matter.

My point was that the threat of prohibiting libre Linux isn't from all manufacturers deciding to lock out installing Linux on their devices. But rather from remote attestation making it so that Google (et al) are able to force you to run a locked down operating system as a technically-enforced condition of interacting with their servers.

I am a big supporter of AT Protocol, and I contribute some money to a fund to build on it. Why laugh at running experiments? Nothing will "save us," it is a constant effort as long as humans desire to use these systems to connect. Email exists today, and is very usable still as a platform that cannot be captured. The consolidation occurred because people do not want to run their own servers, so we should build for that! Bluesky and AT Protocol are experiments in building something different, with different use cases and capabilities, that also cannot be captured. Just like email. You can run your own PDS. You can run your own stack from PDS to users "end to end" if you so choose. You can pay to do both of these tasks. No one can buy this or take it away from you, if it is built on protocols instead of a platform someone can own and control.

Regulation would be great. The EU does it well. It is lacking in the US, and will be for some time. And so we have to downgrade to technical mitigations against centralization until regulation can meet the burden.

e-mail can't handle 24/7 1k posts/sec traffic which Twitter was about. A more appropriate analogue is IRC.

This is becoming a common pattern everywhere now.

Case in point (and sorry for bringing up this topic), LLM providers seem to be doubling down on automatic model selection, and marketing it as a feature that improves experience and response quality for the users, even though it's a blatant attempt to cut serving costs down by tricking users (or taking the choice away) into querying a cheaper, weaker model. It's obviously not what users want - in this space, even more than in video streaming, in 90%+ of end-user cases, what the user wants is the best SOTA model available.

At least with YouTube, I recall them being up front about this in the past, early in the COVID-19 pandemic - IIRC the app itself explained in the UI that the default quality is being lowered to conserve bandwidth that suddenly got much more scarce.

It is enabled by default. One creator of English language content had their video misclassified as Spanish and people were getting a machine English dub on an English video. Support to fix it appears to be a nightmare.

I don't want it dubbed whether I speak the language or not.

What about the auto translated titles? It also happens for chapters in the video...

Sames languages as you. It drives me nuts because the translations are almost always wrong.

Comments are quite good at pointing out when the creator has accidentally left it on (it is of course enabled by default and authors have to actively disable it).

> Auto-generated subtitles for other languages are ok, but I want to listen to the original voices!

The first time I saw this feature, it was on a cover of some pop song in a foreign language. Why on Earth... ?

I haven't tested this, but in theory running deno with `--v8-flags='--jitless'`[^1][^2] will disable the JIT compiler.

[^1]: https://v8.dev/blog/jitless

[^2]: https://docs.deno.com/runtime/getting_started/command_line_i...

well yt-dlp would also be banned surely? so it's not an issue anyway

I was talking to "my friend" about how I'm annoyed my calendar duplicates holidays because it imports from multiple calendars and he asked me "what value" would be provided if this was solved. Confused I said it pushes things off so I can't read events. He clarified he meant monetary value...

We're both programmers so we're both know we're talking about a one line regex...

I know quite a number of people like this and they're in high positions at big tech companies... doesn't take a genius to figure out why everything has such shitty user experiences and why all the software is so poorly written. No one even seems to care about the actual product they'll only correct you to tell you the product is the stock and the customer is the shareholder, not the user.

We fucked up...

  > So, after estimating the number of ping pong balls that fit on a 747, the thing to do is to go write the regexp and put that on your promo packet.

  > User retention is a thing.

  > As a big tech programmer, it's almost never that simple...

and removed when that person who is promoted doesn't work on it again

You're assuming startups are all tech. At my job, tech is not even 1/3 of employees.

Roku tho

ah yes, let me just install a browser extension on the kids ipad

I'm not waiting for the collapse to fix things - I'm waiting for it so that I won't have any more distractions and I can go back to my books.

Look at history, things improve and then things get worse, in cycles.

During the "things get worse" phase, why not make it shorter?

>AI companies

Like Google?

>scraping YT without paying YT let alone creators for training data

Like Google has been doing to the entire internet, including people’s movement, conversations, and habits… for decades?

- Enforce views of ads

(not debating the validity of this reason, but this is the entire reason Youtube exists, to sell and push ads)

Then they should allow a download API for paying customers.

Who says these are valid?

Why is this being downvoted? Are people really gonna shoot the messenger and fail to why a company may be willing to protect their competitive position?

What evidence is telling the opposite?

Scripts use V8 isolation, identical to Chrome. What comes to rest, we can only trust or review by ourself, but it is certainly better than nothing in this context.

I use another app from F-Droid called Skytube for occasional downloads. I like it.

https://f-droid.org/en/packages/free.rm.skytube.oss/

https://f-droid.org/en/packages/free.rm.skytube.legacy.oss/

What do you mean by signing? Application signing on android is done by the developer, with their own key. Or by fdroid, in the case of apps built by fdroid in the default repository.

as soon as they have a map app that works with car play i'm switching to linux phone.

"If Google ever stops signing apps like that, I'll be switching to a LInux phone."

Is this another way of saying, "I will keep using it until it stops working"

LLMs solve challenges. Can we not solve these challenges with sufficiently advanced LLMs? Gemini even, if you're feeling lulz-y.

I think you need to read the comment I was responding to a bit more carefully. (Hint, they would not have made that comment had their kid had an Android tablet)

But you don't need it for Android... Can happily install uBlock Origin on bog standard Firefox there.

Ain't that right, eh? It's not the end of the world. Just the end of a whole lot of nice and fun possibilities we've grown to enjoy.

Firefox is in decline and Brave will soon overtake it. Brave blocks ads natively. There is a lot of advantage in that but we also may eventually have a new model that funds the internet. And I don't see Firefox or Safari disrupting advertising.

https://data.firefox.com/dashboard/user-activity

https://brave.com/transparency/

  This is interesting because it is a clear violation of the idea that browser vendors should not give preference to their websites over anyone elses.

  > https://data.firefox.com/dashboard/user-activity
  > https://brave.com/transparency/

How does testing rendering work? Can javascript get pixel data from the DOM

why can a bot dev not just get all of these values from the laptop's settings and hardwire the headless version to have the same values?

It doesn’t have granularity in terms of what parts of the code have what permission - everything in the same process has the same permission, but aside from that I’m not sure what you mean about it being paper thin. Certainly WASM is a great option, and I think it can facilitate a more nuanced capabilities model, but for cases like this AFAIK Deno should be secure (to the extent that V8 is secure, which Chrome’s security depends on).

It being a checkbox feature is a weird way to frame it too, because that typically implies you’re just adding a feature to match your competitors, but their main competitors don’t have that feature.

In what ways does it fall short? If there are major gaps, I’d like to know because I’ve been relying on it (for personal projects only myself, but I’ve recommended it to others for commercial projects).

WASM can not run JavaScript unfortunately.

> Rumble and Odysee and populated with crazy ragebaiting rightwingers, conspiracy theorists, and pseudo-libertarians.

So, just like Youtube, then?

Why should they agree to make life even easier for people doing something they don't want?

They obfuscate it more than just pressing "Yes". You get a big warning saying Microsoft Defender has protected you, and the only clear option is "Don't run"

https://cdn.advancedinstaller.com/img/prevent-smartscreen-fr...

In order to run, you have to click on "More info", and then a second "Run anyway" button appears.

There's way more than 5% of the Windows userbase that gets confused and can't get past this warning.

Depends, I ran into this issue[1] a while ago with unsigned binaries.

[1] https://news.ycombinator.com/item?id=40815488

sometimes, it's not about the cost. it's about who/where the money is being spent.

This is just one element among many others. They probably have many available and others in reserve in case one becomes obsolete.

I recently discovered that audio codecs, frequencies, resolution, mix volume, etc. are accessible via JS in the browser and that this allows fingerprinting. Since we are talking about YouTube, the same type of technique should be possible with video codecs.

Don't be reductive, people reading this aren't going to fence their opinion of Deno to the "use in YTDLP" case.

I never said it was a poor choice in this specific context but propagating the idea that Deno's sandboxing is safe and "basically the same security as chrome" is wrong and can easily do damage the next time someone that has read this thread needs a way to execute untrusted JS.

YT shares income from subscriptions with music labels? I didn't hear about this, and even if they shared the download must be paid much higher than a view because after downloading a person could potentially listen for a track hundred times in a row.

Oh, there's plenty of these, here's just one example: https://www.amazon.com/ATOTOOUT-Magic-Box-Built-Bluetooth/dp...

I really do have a lot of respect for Brave and what they're trying to do, don't get me wrong. I think they are trying to address a meaningful problem and I do not think their solution is ill-conceived. I want to be clear about that.

But I do think it is a far bigger problem that we let a single actor have so much control over the fundamental structure of the internet. The problem isn't Brave so much as it is Chromium. But criticizing Brave (and Opera, Edge, etc) is a consequence of this.

You must ask yourself which is the bigger concern?

  - If you believe the major concern is an ad based ecosystem on the internet, then choose Brave. Especially if you believe it is unlikely that data leakage "features" implemented by Google are not likely to be captured by downstream projects.

  - If you believe the major concern is the number one ad based company who's entire market is based on the erosion of data privacy, then choose *literally anything* that is not Chromium based.

I think the latter is far more damning and honestly is an upstream issue to the concern Brave is trying to address. That's why I say I would encourage Brave to move away from Chromium. I actually would encourage them to develop their own engine since I think 3 choices is far from sufficient, but I'll take a Gecko or WebKit version as a major victory.

But this is my opinion. There is no right answer here. It has to come down to you.

If you agree with me then I'd encourage you to look at Firefox. It is good by default and with a few easy to find options you can have strong privacy and installing uBlock is a trivial task. If you are more privacy conscious, I encourage you to look at the Mullvad Browser, which is a Firefox fork with strong privacy defaults (maintained by the Tor and Mullvad teams). If you want a WebKit then check out Orion. I use this on both my iPhone and iPad (my Macbook and linux desktop are still Firefox), as Orion allows add-ons, so you can get ad blocking on your phone (when I was on Android I just used Firefox mobile which supports extensions). If you really want to encourage a 4th player I believe LadyBird is the popular kid on the block, but I honestly don't know too much and last I knew it was not quite to a stable state.

You don't have to agree with me, but I just want to make people aware that they do have a say in the future. There's no solution that doesn't have drawbacks, but I think on a techie form we should be able to have a more complex discussion and recognize that there are consequences to our choices. I think it is also important to recognize our choices multiply as we tend to be the ones who inform our non-techie peers. If you've ever installed software for a friend or family member, then realize how our choices multiply.

I'd also encourage you to promote more conversations among techie groups so we can hear the diverse set of opinions and concerns. It's a complex world and it is easy to miss something critical.

  > I'm telling you that Firefox is going to be out of business soon

Do you not think everyone saying Firefox is going to be out of business soon plays a role in this?

Regardless, I think you've ignored the root of my argument. I'm not trying to be a Firefox fanboy here but it's not like there's many options. The playing field is Chrome, Firefox, Safari. So only one of these is not "big tech".

  > Metrics can be transmitted without revealing the user. This is well known.

This is not well known and I think you've kinda "told on yourself" here. It is fairly well known in the privacy community that it is difficult to transmit user data without accidentally revealing other information. Here's a rather famous example[0,1]. I'd encourage you to read it and think carefully about how deanonymization might be possible after just reading a description of the datasets they deanonymize.

  > You can't suggest anything. I am done with this conversation.

If you wish to disengage then that is your choice. I am really trying to engage with you faithfully here. I'm not even really attacking Brave here, as my critique is over the Chromium ecosystem. I think if you look at my points again you can see how they would dramatically shift if Brave were based off of Gecko or Webkit. Honestly, I would be encouraging Brave usage were it under those umbrella. Or even better, if it had its own engine! Because my point is about monopolization.

[0] https://courses.csail.mit.edu/6.857/2018/project/Archie-Gers...

[1] https://arxiv.org/abs/cs/0610105

But this, too, skips over some nuance. There are a few types of actors here:

- small content creators who want to make their content accessible to individuals

- companies that want to gobble up public data and resell it in a way that destroys revenue streams for content creators

- gatekeepers like Cloudflare who want to ostensibly stop this but will also become rent-extractors in the process

- users who should have the right to use personal tools like yt-dlp to customize their viewing experience, and do not wish to profit at the expense of the creators

We should be cautious both that the gatekeepers stand to profit from their gatekeeping, and that their work inhibits users as well.

If creators feel this type of user (often a dedicated fan and would-be promoter) is a necessary sacrifice to defend against predatory data extractors… then that’s absolutely the creator’s choice, but you can’t say there’s a unified “us” here.

> small-time websites adding Anubis proof-of-work

Those were already public. The issue is AI bot ddos-ing the server. Not everyone has infinite bandwith.

> owners of popular Discord channels turning on the setting for phone # verification as a requirement for joining

I still think that Discord is a weird channel for community stuff. There's a lot of different format for communication, but people are defaulting to chat.

> web blogs wanting to put a "toll gate" (maybe utilize Cloudflare or other service) to somehow make OpenAI and others pay for the content

Paid contents are good (Coursera, O'Reilly, Udemy,...). But a lot of these services wants to have free powered by ads (for audience?).

---

The fact is, we have two main bad actors: AI companies hammering servers and companies that want to centralize content (that they do not create) by adding gatekeeping extension to standard protocols.

> Now everybody on the globe wants to try to make a dollar, and likewise, they feel dollars are being stolen from them.

I'm not in it for the dollar. I just want the licenses I put on my content/code to be respected, that's all. IOW, I don't what I put out there to be free forever (as in speech and beer) to be twisted and monetized by the people who re in this for the dollar.

I don’t feel like dollars are stolen from me. It’s more of companies abusing my goodwill to publish information online. From higher bills as a result of aggressive crawling, to copying my work and removing all copyright/licensing from the code. Sure, fair use and all, but when they return the same exact code it just makes me wonder.

Nowadays, producing anything feels like being the cows udder.

i want my content borrowed/shared, and I still need to be engaged in this stuff because the poorly behaved distributed bots that have arisen in the past year are trying to take boundless resources from my site(s), that I cannot afford.

Then some of those small people are wrong too.

I wish we could all just stop fighting the truth of the tech -- it costs ZERO to make copies of things, and adjust accordingly.

Patreon (and keep it real, OnlyFans) are roughly the only viable long term models.

> The small-time independent publishers and creators also want to restrict the web because they don't want their content "stolen".

I'm sure some music creators may have, years ago, been against CD recorders, or platforms like Napster or even IRC-based file transfer for sharing music. Hell, maybe they were even against VCRs back in the day. But they were misguided at best.

People who want to prevent computer users from freely copying data are, in this context at least, part of "them" rather than "us".

Duh. I've known this for decades. The biggest advocates for DRM I've known are small-time content creators: authors, video producers, musicians. They've been saying the same thing since the 90s: without things like DRM, their stuff would be pirated, and they'd like to earn a living doing what they love instead of grinding at a day job to support themselves while everybody benefits from their creative output. In addition, major publishers and record labels won't touch stuff that's been online because of the piracy risk. They don't want to make an investment in smaller creators without a return in the form of sales of copies. That last bit is less true of music now than it used to be because of streaming and stuff, but the principle still applies.

This is why the DMCA will never be repealed, DRM will never go away, and there is no future for general purpose computing. People want access digital content, but the creators of that content wouldn't release it at all if they knew that it could be copied endlessly by whomever receives it.

It's us vs them. What big corps want is fundamentally adversarial due to it's motivation. I like to think that humans can conceptually not be your enemy.

> The small-time independent publishers and creators also want to restrict the web because they don't want their content "stolen"

... or just keep their site on the Internet. There hasn't been any major progress on sanctioning bad actors - be it people running vulnerable IoT crap that ends up being taken over by a botnet, cybercriminals and bulletproof hosters, or nation state actors. As long as you don't attack targets from your own geopolitical class (i.e. Russians don't attack Russians, a lot of malware will just quit if it spots Russian locale), you can do whatever the fuck you want.

And that is how we end up with darknet services where you can trivially order a DDoS taking down a website you don't like or, if you manage to get your opponent's IP leaked during an online game, their residential IP address. Pay with whatever shitcoin you have, and no one is any wiser who the perpetrator is.

>The small-time independent publishers and creators also want to restrict the web

Oh really? Does Linus's Floatplane go to this extent to prevent users from downloading stuff? Does Nebula? Does whatever that gun youtuber's version of video site do this?

Does Patreon?

It’s like we are living in an affordability crisis and people are tired of 400 wealthy billionaires profiting from peoples largess in the form of free data/tooling.

When Nixon slammed the gold window shut so Congress could keep writing blank checks for Vietnam and the Great Society, it wasn't just some monetary technicality. It was the moment America broke its word to the world and broke something fundamental in us too. Suddenly money wasn't something you earned through sweat or innovation anymore. It became something politicians and bankers could conjure from thin air whenever they wanted another war, another corporate bailout, another vote-buying scheme.

Fast forward fifty years and smell the rot. That same fiscal recklessness Congress spending like drunken sailors while pretending deficits don't matter has bled into every pore of society. Why wouldn't it? When BlackRock scoops up entire neighborhoods with Fed-printed cash while your kid can't afford a studio apartment, people notice. When Tyson jacks up chicken prices to record profits while diners can't afford bacon, people feel it. And when some indie blogger slaps a paywall on their life's work because OpenAI vacuumed their words to train ChatGPT? That's the same disease wearing digital clothes.

We're all living in Nixon's hangover. The "us vs us" chaos you see Discord servers demanding your phone number, small sites gatekeeping against bots, everyone scrambling to monetize scraps that's what happens when trust evaporates. Just like the dollar became Monopoly money after '71, everything feels devalued now. Your labor? Worth less each year. Your creativity? Someone's AI training fuel. Your neighborhood? A BlackRock asset on a spreadsheet.

And Washington's still at it! Printing trillions to "save the economy" while inflation eats your paycheck alive. Passing trillion-dollar "infrastructure bills" that somehow leave bridges crumbling but defense contractors swimming in cash. It's the same old shell game: socialize the losses, privatize the gains. The factory worker paying $8 for eggs understands this. The nurse getting lectured about "wage spirals" while hospital CEOs pocket millions understands this. The teenager locking down their Discord because bots keep spamming scams? They understand this.

Weimar happened when money became meaningless. 1971 happened when promises became meaningless. What you're seeing now the suspicion, the barriers, the every-man-for-himself hustle is what bubbles up when people realize the whole system's running on fumes. The diner owner charging $18 for a burger isn't greedy. The blogger blocking AI scrapers isn't a Luddite. They're just building levees against a flood Washington started with a printing press half a century ago.

The tragedy is that we're all knee-deep in the same muddy water, throwing sandbags at each other while the real architects of this mess the political grifters, the Fed bankers, the extraction-engine capitalists watch dry-eyed from their high ground. Until we stop accepting their counterfeit money and their counterfeit promises, we'll keep drowning in this rigged game. The gold window didn't just close in '71. The whole damn social contract rusted shut.

If any of this was done to combat viewbotting, then any disruption to token calculation would prevent views from being registered - not videos from being downloaded.

Youtube has already accounted for this by using a separate endpoint to count watch stats. See the recent articles about view counts being down attributed to people using adblockers.

Even if they hadn't done that, you can craft millions of bot-sponsored views using a legitimate browser and some automation and the current update doesn't change that.

So I'd say Occam's razor applies and Youtube simply wants to be in control of how people view their videos so they can serve ads, show additional content nearby to keep them on the platform longer, track what parts of the video are most watched, and so on.

I'm sure that's a problem for Youtube. What does it have to do with me rendering Youtube videos on my own computer in the way I want?

Like another comment mentioned: that's a problem for YouTube to solve.

They pay a lot of money to many smart people who can implement sophisticated bot detection systems, without impacting most legitimate human users. But when their business model depends on extracting value from their users' data, tracking their behavior and profiling them across their services so that they can better serve them ads, it goes against their bottom line for anyone to access their service via any other interface than their official ones.

This is what these changes are primarily about. Preventing abuse is just a side benefit they can use as an excuse.

As a viewer, this is not even remotely my problem.

> which undermines trust in the platform

What? What does this even mean? Who "trusts" youtube? It's filled with disinformation, AI slop and nonsense.

That's a lot of words, but I think it boils down to: you're making an assumption that two calendar events with identical naming and identical time entries will always have a desired behavior of being deduped.

- Maybe you want to separately invite people to the same thing and have different descriptions, now you're increasing the number of things to equate.

- Maybe a user creates one event that is simply a title and a time, and they then want to create a second one for another purpose. However, it keeps getting deduped and they don't know why. Now you have a user education problem that you have to solve.

- Now you might think: well just make it a toggle in the settings! Okay well now you have to add a new setting and that expands the scope of the project. Do you make it opt-in or opt-out? If it's opt-in, what if no one uses it? Do you maintain the feature if there's a migration? If it's opt-out, you still have the above problems.

I could go on. And this is mostly an exercise of not underestimating a "simple" change. Calendars (and anything involving time) in particular can get very complicated.

  > will always have a desired behavior of being deduped.

  > Maybe you want to separately invite people to the same thing

  > Maybe a user creates one event that is simply a title and a time,

  > And this is mostly an exercise of not underestimating a "simple" change

> I mean these numbers are just made up anyways, so why are engineers concerned with them?

That's what they're directly or indirectly being graded on. Even if they don't have to show how their work impacted the company's bottom line, their managers or their managers' managers have to, and poop just rolls downhill.

> The idea of engineers needing to justify monetary value is just... ill conceived. They should be concerned with engineering problems. Let the engineering manager worry about the imaginary money numbers.

If this was only possible in this industry. If you're in a small company, you're wearing multiple hats anyway. If you're in a big corp, well, my wife hates that I see this in everything, but - hidden inflation is a thing. As roles are eliminated (er, "streamlined"), everyone is forced to be responsible for things they're not really supposed to care about (my favorite example is filing expense reports).

As you aptly put it upthread: we fucked up...

  > That's what they're directly or indirectly being graded on.

  > my wife hates that I see this in everything, but - hidden inflation is a thing.

Lately I've had to resort to buying avocados from Costco in those little plastic cups because whole avocados in many supermarkets in my region have started to spoil too quickly. Sad.

For general spam deterrence I agree, but how do you prevent paying for the bandwidth in this case?

  > you should give the problem a bit more respect.

The more generalized problem? Absolutely!

The very idealized trivial cases we're discussing and I've stressed we're discussing? I'm unconvinced.

PhD Economists, not PhD Computer Scientists.

Don't worry, people didn't go completely brain dead lol. And most of the economists know about it but not the scale or how it fits in the larger ecosystem. They really just know it as "there's sometimes tools on GitHub".

If the content needs to be copied or downloaded in order to be watched, you may do so exclusively under terms set by the licensor, period. You may not even get fair use rights, as to get the content in the first place you might have to agree to terms of service waiving them, and being found to use the content in an unapproved way would be grounds for cutting off your access.

They'd have to physically steal gold from people, and people would notice that. Or they could mine more gold, but that's hard. Or they could publicly and officially change the exchange rate (of dollars to gold), and people would notice that politicians make it go down, the same way that people notice when politicians make taxes go up (they notice way more than when prices other than taxes go up).

With the current system, they (the central bank) can just increase some people's numbers in some spreadsheets, and the effects are extremely indirect. Nominally this is in exchange for assets of equal value so the situation returns the normal after some time, but that hasn't been happening - the amount of money created this way has not been decreasing at any meaningful rate.

You're goddamn right corruption existed under gold. Nobody's claiming it was some purity paradise. But here's the difference: gold didn't enable systemic looting on a planetary scale. Gold didn't prevent sin. it prevented the industrialization of sin. The robber barons were sharks in a pond. Today's fiat-enabled oligarchs are gods reshaping reality. When you can print the fucking rules, accountability evaporates. That's why Nixon's 1971 decision wasn't just policy. It was an engraved invitation for the largest wealth transfer in human history.

Greed and corruption absolutely festered under the gold standard. Boss Tweed embezzled a fortune from New York City coffers, Vanderbilt strong-armed railroads, and Rockefeller crushed competitors with predatory pricing. But here's the huge distinction: gold acted like a leash on a rabid dog. It didn't kill the beast, but it kept it from devouring the whole goddamn village. When robber barons got too greedy in the 1800s, their schemes imploded under gold's brutal discipline. Jay Cooke's bank collapsed in 1873? No Fed stepped in with trillions in printed cash to resurrect his corpse. Markets purged the rot, losers ate shit, and the system reset in years. Not decades of zombie corporations propped up by cheap debt. Corruption back then was like a bar fight: bloody, ugly, but contained. Tweed stole existing gold coins. He couldn't order the Treasury to mint him a fresh fortune overnight.

Vanderbilt couldn't borrow billions at 0% interest from a central bank to buy every competitor; he had to convince investors with real profits, not financialized vapor. Fast-forward to today: fiat didn't invent greed. It weaponized it. LBJ funded Vietnam and the Great Society without raising taxes because the printer go brrr. BlackRock gobbles neighborhoods with Fed-subsidized debt while renters bleed. Tyson jacks food prices 20%, blames "inflation," and pockets record profits because fiat decouples prices from real value. Banks peddle toxic mortgages knowing the Fed will bail them out. Politicians pass $6T "stimulus" bills while your paycheck buys less bread than a 1950s factory worker's. That's the cancer Nixon unleashed in '71. Not corruption itself, but its metastasis into a globalized, systemic looting operation where elites privatize gains, socialize losses, and inflation becomes a tax on the powerless. Gold didn't stop crooks. It stopped crooks from becoming untouchable gods. The 1800s proved humans will always be greedy. Fiat just gave them the universe's credit card and told your grandkids to foot the bill.

> And it would be impossible to bail out those bonds when they defaulted

Well the US hasn't defaulted so changing how a default works wouldn't really affect the trajectory we took. And a default would be pretty catastrophic either way.

> nor to reuse the bonds to back money.

I don't know what you mean here.

Nixon didn't abandon gold because economists suddenly discovered some brilliant new theory. He did it because the math had already sentenced the system to death. By August '71, Fort Knox was down to its last $11 billion in gold while foreign governments held at least $33 billion in paper dollars screaming for redemption. That's not a liquidity problem. That's a corpse with rigor mortis. And that's just the official tally; the real killer was the eurodollar market, that offshore shadow banking system nobody wanted to talk about, where another $50-70 billion in unredeemable IOUs were sloshing around. Meanwhile, Washington was drowning in $400 billion of federal debt with inflation hitting 6% which was a death spiral where every new bond issuance needed higher interest rates to attract suckers, which only accelerated the bleed-out. France wasn't just cashing checks; they were sending battleships to haul away physical gold while the Fed played musical chairs with reserves. Default wasn't a choice. It was inevitable. Nixon just picked how to default: either formally welch on bond payments (catastrophic) or slam the gold window shut (disguised catastrophe). He chose the quiet betrayal, letting the dollar become pure fiat so Congress could keep funding Vietnam and welfare programs without taxing a soul. That's the original sin. Not just breaking gold's back, but breaking the link between spending and accountability. Fast forward to today: $35 trillion in debt, BRICS nations stockpiling gold while ditching dollars, and your grocery bill doubling not because of "supply chains" but because we've spent fifty years printing to paper over every bad bet. Nixon didn't save the economy. He gave politicians a credit card with no limit and told your grandchildren to pick up the tab.

It didn't have enough gold to pay its bonds, so it could either keep the integrity of the dollars intact while defaulting on the bonds, or keep the integrity of the bonds (as measured in dollars) intact while defaulting on the dollars. The latter option allowed it to last a while longer before anyone would notice.

This choice was made some decades before the official day on which the gold standard ended. By 1971, it had already printed dollars to pay its bonds and didn't have nearly enough gold for foreign countries to be able to withdraw all their gold.