Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Another library released which lies about what it is to circumvent anti-bot security.

Let's just not act surprised when tighter attestation comes in effect.



A future in which YouTube will refuse to stream you data because you didn't pass client attestation is definitely coming and I wish we could stop it.

It is a dark future where some of us will accept it, and rest of us will be constantly taking part in a cat-mouse chase in which we glitch out attestation tokens from vulnerable devices to get by.


We need laws against user-agent discrimination.


Can you describe in a little more detail what exactly client attestation is, and why you would need other devices to achieve it?


Client attestation is a mechanism for servers to get cryptographic proof from a client about what software the client is running. Modified browsers, or software like yt-dlp, would have a harder time providing such proof. How hard a time would depend on the security hardening of the attestation mechanism. It'd almost certainly be broken, just as most attempts at DRM get broken, but it would be one more speedbump.

There are legitimate purposes for attestation; for instance, server attestation can allow a user to run software on a server and know that software matches a specific build and hasn't been subverted, so that the client can trust the server to do computation on the client's behalf.

But one of the leading uses of client attestation is DRM.


This library/program solves problems that people have with pages like youtube... too many ads, no way to download videos for offline use (or archive for when they get removed), and better performance with a native player.

If I was forced to watch all the ads on youtube, i wouldn't watch videos there at all.


I get it. But I don't.

For YouTube you can pay for premium.

Consuming not only their resources but also their incredible streaming algorithm for free is just a dirty move.

Doing this just puts you into the statistic of bad users that incentives companies like Google to push more intrusive DRM. Which at the end of the day makes us all suffer.

Good luck finding an alternative by the way.


And I consider them bad advertisers and just don't care.

We had the internet without ads. Then we had the internet with small banner ads, that didn't track users but were there because of the page content. Then those ads moved from text/image to animated gif, and they became annoying. Then flash was used and it became a security concern. Then the number of ads went up and up, video was introduced, autoplaying, with audio, and at some point most of the internet is unusable without an adblock. It's not something we, the users, wanted, the advertisers (google included) made the internet unusable without an adblock, and that includes 3 25 second ads on a 1m20s video on youtube.

If advertisers returned to non-animated banners above/below the video, we wouldn't have to install adblocks everywhere anymore, and people would see the ad without wanting to kill the advertiser for bad intrusive advertising practices.

They started it, they went too far, we're just reacting to what they're doing. And as we've seen with other platforms, even paying for premium doesn't mean no-ads. And still an adblock is needed to remove the in-video ads ("this video is sponsored by shadow vpn audible").


I used to "save" interesting links by emailing them to myself.

Now most of them are dead, twitter accounts removed, youtube videos deleted, facebook pages bought by media management companies, sites rebuilt etc.

Whatever the primary goal if this tool, it, and other similar tools, are invaluable in actually saving and preserving content


Anti-bot is just a lied to block real human users you don't like/care about. Bots don't work for themselves.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: