frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Show HN: Project health insights for critical open source

https://insights.linuxfoundation.org/
1•jonathan_re•22s ago•0 comments

Record-Breaking DDoS Attack Peaks at 22 Tbps and 10 Bpps

https://www.securityweek.com/record-breaking-ddos-attack-peaks-at-22-tbps-and-10-bpps/
1•Bender•1m ago•0 comments

GeoServer Flaw Exploited in US Federal Agency Hack

https://www.securityweek.com/geoserver-flaw-exploited-in-us-federal-agency-hack/
1•Bender•1m ago•0 comments

Rocks, Pebbles, Sand: How to implement in practice (2020)

https://longform.asmartbear.com/rocks-pebbles-sand/
1•tosh•3m ago•0 comments

YC sending mass spam through GitHub issues

https://github.com/notify-ycombinator/ycombinator/issues
1•not_your_vase•4m ago•2 comments

Don't even consider starting with Microsoft

https://lionelbarrow.substack.com/p/dont-even-consider-starting-with
1•lbarrow•4m ago•0 comments

Ask HN: Human in the loop error reporters: your thoughts?

1•oresorus•4m ago•0 comments

UK agency makes arrest in airport cyberattack investigation

https://www.theregister.com/2025/09/24/uk_agency_makes_arrest_in/
1•Bender•5m ago•0 comments

From Steam to Floppy: Porting Modern TypeScript to Run on DOS

https://jimb.ly/2025/09/23/qauntumpulse-from-steam-to-floppy/
2•todsacerdoti•9m ago•0 comments

Google-sponsored DORA report reframes AI as central to software development

https://www.theregister.com/2025/09/24/googlesponsored_dora_report_reframes_ai/
2•rntn•9m ago•0 comments

Gauss, an Agent for Autoformalization

https://www.math.inc/gauss
1•Gedxx•10m ago•0 comments

Qosh Tepa Canal: over 100 miles, Taliban largest engineering project

https://en.wikipedia.org/wiki/Qosh_Tepa_Canal
1•vinnyglennon•13m ago•0 comments

Cloudflare Turns 15: The Origin Story from Its Co-Founders

https://www.youtube.com/watch?v=I5m27tO78Ek
1•emot•13m ago•0 comments

'Send a clear message': law firm's dirty tactics on behalf of $4B crypto scam

https://www.thebureauinvestigates.com/stories/2025-09-23/send-a-clear-message-law-firms-dirty-tac...
4•latein•14m ago•1 comments

Europe gets another year of Windows 10 updates for free [pdf]

https://www.euroconsumers.org/wp-content/uploads/2025/09/Euroconsumers_vs_Microsoft_092025.pdf
2•teekert•15m ago•0 comments

Components as Data

https://medium.com/@nathanacurtis/components-as-data-2be178777f21
1•vinaythoke•15m ago•0 comments

Send (real) money with Python in 49 currencies

https://vineyard-payments.com/send-real-money-with-python-in-49-currencies/
2•adamkurkiewicz•21m ago•2 comments

Multi-tenant dashboards in SaaS: how Embeddable solved security and scale

https://embeddable.com/blog/multi-tenant-dashboards-in-saas-how-embeddable-handles-security-and-s...
1•hjkm•21m ago•0 comments

Show HN: A simple file conversion API

https://converthub.com/api
1•venelinkochev•22m ago•0 comments

Software substrates: should there be only one? [pdf]

https://www.humprog.org/~stephen/research/papers/kell25substratus.pdf
1•todsacerdoti•23m ago•0 comments

Inflammatory pain in mice has light cycle-dependent effects on sleep

https://www.nature.com/articles/s41386-025-02152-w
1•PaulHoule•23m ago•0 comments

The surprisingly lucrative business of making a list of 500 stocks

https://www.npr.org/sections/planet-money/2025/09/23/g-s1-90054/how-does-the-s-p-500-work
2•andsoitis•23m ago•0 comments

Crypto billionaire is launching first private space station

https://www.cnn.com/science/vast-worlds-first-commercial-space-station-spc
1•huhtenberg•25m ago•1 comments

From Vienna, with Open Source: XDC 2025

https://www.collabora.com/news-and-blog/news-and-events/from-vienna-with-open-source-xdc-2025.html
1•losgehts•26m ago•0 comments

Typer by FastAPI – build great CLIs

https://github.com/fastapi/typer
1•subset•26m ago•0 comments

Pixi global: now with desktop shortcuts and CLI autocompletions

https://prefix.dev/blog/using-pixi-as-a-system-package-manager-with-shortcuts-and-completions
1•todsacerdoti•26m ago•0 comments

Warren Buffett's Berkshire Hathaway Exits China's BYD, Filing Shows

https://www.reuters.com/business/autos-transportation/warren-buffetts-berkshire-hathaway-exits-ch...
3•ironyman•28m ago•0 comments

LLM models pass CFA level III exam

https://www.cfabenchmark.com/
1•geox•31m ago•0 comments

Ask HN: How would you design a business model that supports plugin-writers?

1•aethertap•33m ago•2 comments

Show HN: Synced.it – A2A group scheduling (10k students using it)

https://synced.it
1•nickharty•35m ago•0 comments
Open in hackernews

Yt-dlp: Upcoming new requirements for YouTube downloads

https://github.com/yt-dlp/yt-dlp/issues/14404
168•phewlink•2h ago

Comments

eth0up•1h ago
SABR
tomalaci•1h ago
You need at least 5 letters for Wordle.
VladVladikoff•57m ago
What does the Society of American Baseball Research have to do with this?
bontoJR•53m ago
Sneak Attack By Roger?
adzm•52m ago
This is unrelated to the JavaScript challenge this post is about, and a very specific technology for video streaming. SABR means "server-side adaptive bitrate" and is a bespoke video streaming protocol that Google is moving towards, away from the existing DASH protocol. There is some info here https://github.com/LuanRT/yt-sabr-shaka-demo
pluc•52m ago
it's pronounced sabray
jumpocelot•50m ago
"In 2025, YouTube started rolling out a new streaming protocol, known as SABR, which breaks down the video into smaller chunks whose internal URLs dynamically change rather than provide one whole static URL. This is problematic because it prevents downloaders (such as yt-dlp) from being able to download YouTube videos at resolutions higher than 360p due to only detecting format code 18 (which is the only format code available that doesn't use SABR). So far, this issue has only affected the web client, so one workaround would be to use a different client, such as tv_embedded (where SABR has not yet been rolled out to), so for instance in yt-dlp you could add --extractor-args "youtube:player_client=tv_embedded" to use that client. It is not known how long this workaround will work as intended, as YouTube rolls out SABR to more and more clients."

https://wiki.archiveteam.org/index.php/YouTube/Technical_det...

sphars•39m ago
Thanks for the comment, OP just throwing out just "SABR" like we're all supposed to know what it means.
progbits•1h ago
Can anyone explain specifically what the YT code does that the existing python interpreter is unusable and apparently quickjs takes 20 minutes to run it?

Is it just a lot of CPU-bound code and the modern JIT runtimes are simply that much faster, or is it doing some trickery that deno optimizes well?

progbits•57m ago
From https://github.com/ytdl-org/youtube-dl/issues/33186

> Currently, a new style of player JS is beginning to be sent where the challenge code is no longer modular but is hooked into other code throughout the player JS.

So it's no longer a standalone script that can be interpreted but it depends on all the other code on the site? Which could still be interpreted maybe but is a lot more complex and might need DOM etc?

Just guessing here, if anyone knows the details would love to hear more.

zenmac•40m ago
Yeah that is guess google using spaghetti code to keep their yt moat.
Chris2048•14m ago
Could something like tree-shaking be used to reduce the player code to just the token generating bit? Or does the whole player js change for each video?
zelphirkalt•8m ago
Sounds like a really silly way to engineer things, but then again Google has the workforce to do lots of silly things and the cash to burn, so they can afford it.
ACCount37•53m ago
YouTube is mining cry-

I mean, running some unknown highly obfuscated CPU-demanding JS code on your machine - and using its results to decide whether to permit or deny video downloads.

The enshittification will continue until user morale improves.

adzm•1h ago
I was surprised they went with Deno instead of Node, but since Deno has a readily available single-exe distribution that removes a lot of potential pain. This was pretty much just a matter of time, though; the original interpreter in Python was a brilliant hack but limited in capability. It was discussed a few years ago for the YouTube-dl project here https://news.ycombinator.com/item?id=32793061
nicce•58m ago
Node does not have the concept of security and isolation like the Deno has. There is maintainer comment in the same thread.
arbll•56m ago
The sandboxing features of Deno also seem to have played a role in that choice. I wouldn't overly trust that as a security layer but it's better than nothing.
CuriouslyC•53m ago
Deno sandboxing is paper thin, last time I looked they had very simple rules. It's a checkbox feature. If you want isolation use WASM.
ndjddirbrbrbfi•46m ago
It doesn’t have granularity in terms of what parts of the code have what permission - everything in the same process has the same permission, but aside from that I’m not sure what you mean about it being paper thin. Certainly WASM is a great option, and I think it can facilitate a more nuanced capabilities model, but for cases like this AFAIK Deno should be secure (to the extent that V8 is secure, which Chrome’s security depends on).

It being a checkbox feature is a weird way to frame it too, because that typically implies you’re just adding a feature to match your competitors, but their main competitors don’t have that feature.

In what ways does it fall short? If there are major gaps, I’d like to know because I’ve been relying on it (for personal projects only myself, but I’ve recommended it to others for commercial projects).

CuriouslyC•14m ago
Last I looked it was just very basic pattern matching allow/deny with no real isolation, and there have been multiple real escapes already. It's better than nothing, and probably good enough for bush league security, but I wouldn't pitch it to my milspec customers.
trilogic•1h ago
No requirements for me. I don´t use YT at all :) There are plenty of better alternatives.
frizlab•57m ago
until someone shares a video with you
jamesnorden•55m ago
Thanks for letting us know!
VladVladikoff•54m ago
My brother sent me a long talk on YouTube and pleaded with me to listen to it. Watching was pointless the video was just talking heads sitting in chairs. However you can’t just play a video and turn off your phone while listening to the audio on headphones. The mobile browser sleeps and the audio stops. So I used yt-dlp to rip the audio and dropped it into my Plex server to listen to with Prologue. It wasn’t even about the ads, I just wanted to do some gardening and listen to something on headphones while I worked, without my phone screen on.
4gotunameagain•33m ago
https://newpipe.net/

You're welcome

ndriscoll•30m ago
Firefox Mobile has an extension "Video Background Play Fix" to disable the Page Visibility API anti-feature.
exitb•53m ago
It's obviously not about YT the product, but about YT the content library. I don't think there are better alternatives to that content library.
blacklion•53m ago
I'm watching not youtube but video creators. There is no even worse alternative if person you want to watch doesn't publish video on other site.

Maybe, for watching "recommended" stream without any subscriptions there are alternatives (which? I cannot name good ones, anyway), but if you watch your subscription you are bound to platform which contain this subscription. And no, content creators are not interchangeable.

piyuv•57m ago
I’m a paying YouTube premium subscriber. Last weekend, I wanted to download something so I can watch it on my way in the train. The app got stuck at “waiting for download..” on my iPad. Same on iPhone. Restart did not work. I gave up after an hour (30 mins hands on trying stuff, 30 mins waiting for it to fix itself). Downloaded the video using yt-dlp, transferred it to my USB c flash drive, and watched it from that.

Awaiting their “premium cannot be shared with people outside household” policy so I can finally cancel. Family members make good use of ad-free.

beerandt•50m ago
Canceled mine after ad-free stopped working on YouTube Kids of all things (on ShieldTV). Was probably a bug, but with practically no customer service options, no real solutions besides cancel.

I was also a holdover from a paying Play Music subscriber, and this was shortly after the pita music switchover to youtube, so it was a last straw.

masklinn•49m ago
Even more hilariously, if you upload to YouTube then try to download from your creator dashboard thing (e.g. because you were live-streaming and didn’t think to save a local copy or it impacts your machine too much) you get some shitty 720p render while ytdlp will get you the best quality available to clients.
shantara•48m ago
I’m another Premium user in the same position. I use uBlock Origin and Sponsorblock on desktop and SmartTube on my TV. I pay for Premium to be able to share ad-free experience with my less technical family members, and to use their native iOS apps. If they really tighten the rules on Premium family sharing, I’ll drop the subscription in an instant.
al_borland•2m ago
I’m a Premium user and primarily watch on AppleTV. A little while ago they added a feature where if I press the button to skip ahead on the remote when a sponsor section starts, it skips over the whole thing. It skips over “commonly skipped” sections.

While it doesn’t totally remove it, it lets me choose if I want to watch or not, and gets me past it in a single button press. All using the native app. I was surprised the first time this happened. I assume the creators hate it.

cactusplant7374•41m ago
Why not use Brave browser and their playlist feature for offline downloads?
piyuv•38m ago
I’m not using brave browser so did not know it could download videos
femtozer•33m ago
I also pay for YouTube Premium, but I still use ReVanced on my smartphone just to disable auto-translation. It’s absolute madness that users can’t configure this in the official app.
piyuv•29m ago
It’ll be fixed when some product manager can offer it as a promotion project
the_af•2m ago
The auto-dub feature is madness. I noticed it first a couple of days ago, I'm crossing my fingers that few authors choose to enable it, and that YouTube makes it easy to disable as a default in settings (not currently possible, you have to do it as you watch, every time).

I'm in a Spanish speaking country, but I want to watch English videos in English.

Auto-generated subtitles for other languages are ok, but I want to listen to the original voices!

ac29•23m ago
> Awaiting their “premium cannot be shared with people outside household” policy so I can finally cancel

That's been a policy for a while, the sign up page prominently says "Plan members must be in the same household".

No idea if its enforced though.

beala•22m ago
I'm also a premium subscriber, and have struggled with the same issues on the iPad app. I try to keep some shows downloaded for my toddler, and the download feature never seems to work on the first try.

I finally got so fed up, I bought a Samsung Galaxy Tab A7 off ebay for $50 and flashed it with LineageOS. I can now load whatever media I want onto the 1 TB sdcard I've installed in it. The 5 year old hardware plays videos just fine with the VLC app. And, as a bonus, I discovered that NewPipe, an alternative YouTube client I installed through the F-Droid store, is actually much more reliable at downloading videos than the official client. I was planning on using yt-dlp to load up the sdcard, but now I don't even need to do that.

maplethorpe•17m ago
What video did you watch?
meindnoch•6m ago
>Awaiting their “premium cannot be shared with people outside household” policy so I can finally cancel.

Then I have good news for you! https://lifehacker.com/tech/youtube-family-premium-crackdown

In fact, I've got an email from them about this already. My YT is still ad-free though, so not sure when it's going to kick in for real.

yolo_420•5m ago
I am a premium subscriber so I can download via yt-dlp in peace without any errors or warnings.

We are not the same.

arbll•55m ago
I wonder if we're going to see JS runtime fingerprinting attempt from google now
jeroenhd•48m ago
I doubt it'd be difficult for Google to detect if the client is a browser or not. They already need to check for signals of abnormal use to detect things like clickfarms and ad scams.
tomalaci•55m ago
Looks like this runtime is written in Rust. Really does seem like Rust is rapidly swallowing all kinds of common tools and libraries. In this case a single compiled binary for multiple architectures is quite convenient for something like yt-dlp.
jeroenhd•50m ago
Deno itself is written mostly in Rust, but it also leverages [1] Google's V8 Javascript engine which is written in C++.

[1]: https://choubey.gitbook.io/internals-of-deno/architecture/v8

est•54m ago
I really appreciate the engineering effort went into this "JavaScript interpreter"

https://github.com/yt-dlp/yt-dlp/blob/2025.09.23/yt_dlp/jsin...

stevage•40m ago
heh, that's pretty cool.
supriyo-biswas•37m ago
Heh, now I wonder how much JavaScript it actually interprets and given that it’s < 1000 lines, whether it could be used towards an introductory course in compilers.
LordShredda•26m ago
I'm on mobile, this seems like an actual js interpreter that only does objects and arithmetic. Impressive that it went that far
m_ke•52m ago
I used to work on video generation models and was shocked at how hard it was to find any videos online that were not hosted on YouTube, and YouTube has made it impossibly hard to download more than a few videos at a time.
fibers•39m ago
you have to feed it multiple arguments with rate limiting and long wait times. i am not sure if there have been recent updates other than the js interpreter but ive had to spin up a docker instance of a browser to feed it session cookies as well.
Andrews54757•49m ago
Nsig/sig - Special tokens which must be passed to API calls, generated by code in base.js (player code). This is what has broken for yt-dlp and other third party clients. Instead of extracting the code that generates those tokens (eg using regular expressions) like we used to, we now need to run the whole base.js player code to get these tokens because the code is spread out all over the player code.

PoToken - Proof of origin token which Google has lately been enforcing for all clients, or video requests will fail with a 404. On android it uses DroidGuard, for IOS, it uses built in app integrity apis. For the web it requires that you run a snippet of javascript code (the challenge) in the browser to prove that you are not a bot. Previously, you needed an external tool to generate these PoTokens but with the Deno change yt-dlp is now capable of producing these tokens by itself.

SABR - Server side adaptive bitrate streaming, used alongside Google's User Messaging Platform (UMP) protocol to allow the server to have more control over buffering, given data from the client about the current playback position, buffered ranges, and more. This technology is also used to do server-side ad injection. Work is still being done to make 3rd party clients work with this technology (sometimes works, sometimes doesn't).

ACCount37•34m ago
If you ever wondered why the likes of Google and Cloudflare want to restrict the web to a few signed, integrity-checked browser implementations?

Now you know.

codedokode•29m ago
There could be valid reasons for fighting downloaders, for example:

- AI companies scraping YT without paying YT let alone creators for training data. Imagine how many data YT has.

- YT competitors in other countries scraping YT to copy videos, especially in countries where YT is blocked. Some such companies have a function "move all my videos from YT" to promote bloggers migration.

toomuchtodo•24m ago
- Enforce views of ads

(not debating the validity of this reason, but this is the entire reason Youtube exists, to sell and push ads)

baxuz•24m ago
Then they should allow a download API for paying customers.
dylan604•13m ago
It's not YT's content though.
transcriptase•23m ago
>AI companies

Like Google?

>scraping YT without paying YT let alone creators for training data

Like Google has been doing to the entire internet, including people’s movement, conversations, and habits… for decades?

Chris2048•21m ago
Who says these are valid?
supriyo-biswas•5m ago
Why is this being downvoted? Are people really gonna shoot the messenger and fail to why a company may be willing to protect their competitive position?
supriyo-biswas•23m ago
At least for YouTube, viewbotting is very much a thing, which undermines trust in the platform. Even if we were to remove Google ads from the equation, there’s nothing preventing someone from crafting a channel with millions of bot-sponsored views and comments, in order to paid sponsor placements, etc.

The reasons are similar for Cloudflare, but their stances are a bit too DRMish for my tastes. I guess someone could draw the lines differently.

rwmj•10m ago
I'm sure that's a problem for Youtube. What does it have to do with me rendering Youtube videos on my own computer in the way I want?
ForHackernews•9m ago
> which undermines trust in the platform

What? What does this even mean? Who "trusts" youtube? It's filled with disinformation, AI slop and nonsense.

supriyo-biswas•6m ago
I provided an example is given right after that sentence. Trustworthiness of the content is an entirely separate thing.
ACCount37•9m ago
If any of this was done to combat viewbotting, then any disruption to token calculation would prevent views from being registered - not videos from being downloaded.
dylan604•15m ago
> For the web it requires that you run a snippet of javascript code (the challenge) in the browser to prove that you are not a bot.

How does this prove you are not a bot. How does this code not work in a headless Chromimum if it's just client side JS?

Andrews54757•5m ago
Good question! Indeed you can run the challenge code using headless Chromium and it will function (this is how yt-dlp works now). They are constantly updating it however, and may add additional checks in the future. I suppose they want to make it more expensive for botters to scrape Youtube.
sphars•49m ago
This will be interesting to see how it affects the numerous Android apps on F-Droid that are essentially wrappers around yt-dlp to create a YouTube Music clone.
BoredPositron•46m ago
Ugh... Deno. After they started to extort the JS community for money to fund their PR stunt against Oracle and the resulting "last chance" trademark dispute, I stay as far away from it as I can.
MangoToupe•44m ago
At some point we’re going to need a better place to put videos than YouTube. The lack of any democratization of bulk storage is beginning to be a real problem on the internet.

Yes, we have archive.org. We need more than that, though.

I’m sure there’s some distributed solution like IPFS but I haven’t seen any serious attempt to make this accessible to every day people.

zenmac•36m ago
There are: peertube, odysee, minds, rumble, bitchute web torrent)...

It is the same reason why people just can't get off IG. Network effect and in YT case a lot of disk space and bandwidth.

coldpie•36m ago
> The lack of any democratization of bulk storage is beginning to be a real problem on the internet.

There are many thousands of paid hosting services, feel free to pick one. It turns out hosting TB of data for free is a pretty tricky business model to nail down.

reaperducer•35m ago
I keep seeing ads on TV for Photobucket (Which I thought was dead) for 1TB of storage for either free, or $5, depending on the ad.

Maybe there is an opportunity for that company to expand.

bob1029•14m ago
If you want to compete with YT you need to basically build AWS S3 in your own data centers. You'd have to find a way to make your service run cheaper than google can if you wanted to survive. You'd have to get very scrappy and risky. I'd start with questions like: how many 9s of durability do we actually need here? Could we risk it until the model is proven? What are the consequences for losing cat videos and any% speed runs of mario64? That first robotic tape library would be a big stepwise capex event. You'd want to make sure the whole thing makes sense before you call IBM or whoever for a quote.
apetresc•35m ago
The writing is on the wall for easy ripping. If there's any YT content you expect you'll want to preserve for a long time, I suggest spinning up https://www.tubearchivist.com/ or something similar and archiving it now while you still can.
lyu07282•12m ago
They already had the proper-DRM tech for youtube movies for years, why didn't they already turn that on for all content?
feverzsj•34m ago
That's why youtube is so buggy and slow.
ivanjermakov•29m ago
Can we remove heartdropping mystery from the title? My first thought is that Google's makes it more difficult to download from YouTube.

"yt-dlp moves to Deno runtime"

Fabricio20•12m ago
Google is making it harder to download from Youtube. Your first thought is correct! Every other website that yt-dlp supports doesn't require this change. Additionally, yt-dlp is still written in python, it has not moved to deno. They are only adding a deno dependency for the javascript challenges added by youtube.
zelphirkalt•27m ago
What I found much more annoying, and so far have not been able to work around, is that yt-dlp requires you to have a YouTube account, something that I have not had for a decade or so, and am unwilling to create again.

What tool can I use to simply store what my browser receives anyway, in a single video file?

skydhash•21m ago
It must be a pretty recent (as in added yesterday) addition, as I was watching youtube with mpv+yt-dlp.
degamad•20m ago
When did it start requiring one? It didn't require one the last time I used it a few months ago...
ACCount37•5m ago
Google started using IP range blocks recently. If they decide that your IP stinks, they'll block YouTube viewing and demand that you log in.

It's inconsistent as fuck, and even TOR exit nodes still work without a log in sometimes.

2OEH8eoCRo0•13m ago
> What tool can I use to simply store what my browser receives anyway, in a single video file?

This. I'm interested in such a tool or browser extension.

wraptile•25m ago
Days of just getting data off the web are coming to an end as everything requires a full browser running thousands of lines of obfuscated js code now. So instead of a website giving me that 1kb json that could be cached now I start a full browser stack and transmit 10 megabytes through 100 requests, messing up your analytics and security profile and everyone's a loser. Yay.
sharperguy•19m ago
Why can youtube not just give a micropayments backed API? Just charge a few cents per video download and be done with it.
1bpp•11m ago
Because they already charge macropayments for that.
rcarmo•18m ago
So, instead of using something lightweight and embeddable like QuickJS, they opted for Deno? Nothing specifically against it, just seems... overkill
zb3•12m ago
Fortunately the community is not alone in this fight, because many AI companies need to be able to download YT videos. But they should sponsor yt-dlp more directly..
zelphirkalt•7m ago
How will this JS execution be contained/isolated? Do we have to run it inside a VM, or containers?
BolexNOLA•4m ago
What are folks thoughts on jdownloader2 these days? Hell is that still kicking?
nikcub•2m ago
Just the other day on here there was a story posted on hn[0][1] that said YouTube secretly wants downloaders to work.

It's it's always been very apparent that YouTube are doing _just enough_ to stop downloads while also supporting a global audience of 3 billion users.

If the world all had iPhones or modern android devices you'd bet they'd straight up DRM all content

[0] https://windowsread.me/p/best-youtube-downloaders

[1] https://news.ycombinator.com/item?id=45300810