yt-dlp VS widevine-l3-decryptor

You can put these options in a config file and they will become the default: https://github.com/yt-dlp/yt-dlp?tab=readme-ov-file#configur...

Yep. yt-dlp and youtube-dl

https://github.com/yt-dlp/yt-dlp

https://github.com/ytdl-org/youtube-dl

Will also start to feel the impact. My theory is that we will see a bunch of new video hosting sites as youtube itself attempts to lock down its ecosystem. They haven't paid attention in any adversarial way as far as I can tell.

When they do, it wont be great.

The points you make aren't unreasonable.

It is necessary to establish clear boundaries of what can and can be provided by the maintainers. If not done at an earlier stage of the project, the support burden becomes too much to bear at which point the maintainer transfers ownership, and the project suffers from catastrophic consequences such as the xz backdoor we're talking about here, or other cases where the project mostly stalls and serves as an ego-boosting platform for the new maintainer, as was the case with PhantomJS[6].

This can also happen in your life, where a "friend" sees that you possess a certain skill, and then gradually tries to push an inordinate amount of their personal work related to this field onto you.

Personally, I think it's best to use an approach with extremely clear communication as to what the maintainer can and cannot provide. This can be seen, for example, in yt-dlp[1], where the consumer is clearly informed upfront that not providing detailed information as requested will lead them to block said consumer; or sqlite where their position regarding contributed patches[2] and support[3] is similarly made clear.

Having a shouty BDFL like Torvalds can also help improve code quality[4] and questionable contributions[5], though it is better that the shouty BDFL makes statements that are professional and do not show as much aggression; so for example, "Mauro, shut the fuck up"[7] would become "Mauro, your response is completely unbecoming for a Linux kernel maintainer, and is not in line with the promise of not breaking userspace."

[1] https://github.com/yt-dlp/yt-dlp/issues/new?assignees=&label...

[2] https://www.sqlite.org/copyright.html

[3] https://www.sqlite.org/support.html

[4] https://www.theregister.com/2024/01/29/linux_6_8_rc2/

[5] https://cse.umn.edu/cs/linux-incident

[6] https://github.com/ariya/phantomjs/issues/14541

[7] https://lkml.org/lkml/2012/12/23/75

Or just "yt-dlp "

yt-dlp ( https://github.com/yt-dlp/yt-dlp ) still works pretty well at the current state of Twitter.

To download audio from YouTube videos, you'll utilize the widely used yt-dlp library, which can be installed using the pip command as follows:

Use: `yt-dlp with --write-comments --no-download --batch-file FILE`

- FILE is a text file with a list of YouTube id's/URL's

- https://superuser.com/a/1732443/4390

- https://github.com/yt-dlp/yt-dlp

> Then youtube-dl wasn't a thing anymore (maybe it is again?)...

yt-dlp is definitely a thing: <https://github.com/yt-dlp/yt-dlp>

It's a part of the browser. It's not doing it with Javascript if that's what you're asking. Chrome includes a file with the name widevinecdm.dll or something like that on Windows. No one knows exactly what this file does because it is incredibly obfuscated https://github.com/tomer8007/widevine-l3-decryptor/wiki/Reve....

As for what Widevine actually does, it just uses a protobuf based protocol to request a decryption key from a license server. License request messages from the client have to be signed with a valid device private key, which are made difficult to extract but some occasionally leak.

Not just privately either, there have been tools circulating even on GitHub.

For a L3 example there's one repo [1] that's kind of still up but not really. Still enough to show that it happened. L1 bypass has also been on GitHub briefly. However these things get deleted rather fast for obvious reasons.

--

[1] https://github.com/tomer8007/widevine-l3-decryptor

Widevine has been broken at least a few times, including by recovering the private key from its white-box implementation: https://github.com/tomer8007/widevine-l3-decryptor/wiki/Reve.... Note that the write-up says it was the "old" version, but that's relative to the date of the write-up. Google overhauled Widevine after he broke it.

I'm less familiar with shielding data like this, but historically things like VMProtect and Themida were the standard for shielding programs. These offer a degree of resistance to automation, but a determined human will eventually figure them out, and then automation usually follows anyway. Syntia did this for VMProtect and Themida: https://www.usenix.org/system/files/conference/usenixsecurit....

For webrip you'll need an hdmi splitter that doesnt abide by HDCP to bypass protections into a capture card. For webdl theres this older github but it doesn't work anymore, im not sure if there's a currently working script and key online publicly https://github.com/tomer8007/widevine-l3-decryptor

There's code for the L3, but it doesn't work since end of may because the new RSA keys aren't public

https://github.com/tomer8007/widevine-l3-decryptor

Find the code in the forks, since it was DMCA'd

There's none for L1 and L2 though

So if for example I `git clone` ed this project back when it was live with the original files, and then `git pull ` now after the maintainer removed project files and all the relevant commits with it, the `git pull` command would just fail?

You can still bypass DRM if you know how or have to programms to do it (With widevine-l3-decryptor for example (The offical key(s) was/were revoked but some people still post keys))