Hacker News new | ask | show | jobs
by 2h 1232 days ago
Ive said it before on GitHub, I dont think `TVHTML5_SIMPLY_EMBEDDED_PLAYER` is the great solution everyone thinks it is. Yeah, you can get the age-restricted videos anonymously. However you can also get those videos by logging in, which the author doesn't mention:

    POST /youtubei/v1/player HTTP/1.1
    Host: www.youtube.com
    Authorization: Bearer ya29.a0AVvZVsqRwNWFI3R0MSxnugyNlxbqIOXcwXkeA6NMOcpv_...
    
    {
     "contentCheckOk": true,
     "context": {
      "client": {
       "clientName": "ANDROID",
       "clientVersion": "18.04.35"
      }
     },
     "racyCheckOk": true,
     "videoId": "Cr381pDsSsA"
    }
and `TVHTML5_SIMPLY_EMBEDDED_PLAYER` comes with strong drawbacks. Some videos under that client require a JavaScript signature for BOTH downloading and unthrottling. Each person is welcome to their own opinion, but I just dont think its worth the complexity of parsing some arbitrary JavaScript with Python when you can just log in (programmatically as above). Personally I use the ANDROID client, which avoids all JavaScript signatures. Also not mentioned in the article is that you can actually take the throttled URLs as is, and download pieces concurrently for a pretty good result. So each piece is still downloading slowly, but if you use on the order of 99 connections, you get decent speed. You would think you get IP blocked or something for this, but I downloaded quite a bit using this method as a test and the YouTube server allowed it. The combined resultant speed was only something like 2 MB/s, so big picture it doesn't seem like an abuse. My YouTube OAuth code is here for any interested:

http://2a.pages.dev/mech

2 comments

> However you can also get those videos by logging in, which the author doesn't mention.

> Also not mentioned in the article is that you can actually take the throttled URLs as is, and download pieces concurrently for a pretty good result.

The author mentioned both, the login option as well as the chunking mechanism. Sorry, but did you actually read the blog post?

they mention cookies. that not the correct method for authenticating to the API, OAuth is.
If you can afford to always be logged in, then sure, but it's not always an option. Especially if you need a general solution.
who said anything about always? you log in as needed. most videos are open.
I mean, if you're not the sole user of the tool, you can't guarantee that everyone can log in (or would want to)
I doubt anyone WANTS to log in. 90% of videos are open. Yes, logging in is a burden, but coding wise its literally one extra line in the HTTP request. I think thats a fair tradeoff compared to parsing arbitrary JavaScript.

each person can weigh the pros and cons and make their own decision, but I dont think its as black and white that TVHTML5_SIMPLY_EMBEDDED_PLAYER is the best option, and the article doesn't even discuss OAuth, so I dont think its presenting a balanced take on the different approaches.