Another day, another cipher change

Well, Youtube broke youtubedown again, and I haven't yet figured out how. Today's cipher is 'vfl-bxy_m' => 'w48 s3 w37 s2', and my Perl code seems to be doing the same thing as the Javascript code's function lj and mj, but it's not working. That algorithm is mapping to a 76 byte string with no period in the middle, which is not typically what they look like, so there must be some new kink somewhere. (Same old sample video.)

Any ideas?

How do you get Safari, Firefox or Chrome to switch to the HTML5 player instead of the Flash player, anyway? I think there used to be a link on the page for that but I don't see it now.

Previously.


Update: I figured it out. This time, they seem to have actually turned off enciphered signatures, but the "use_cipher_signature" parameter is still True. I guess they don't actually use that. So the only way to tell is to see whether the url_map is using s= instead of sig=. Fun times. I was deciphering sigs that were already deciphered. I wonder if this is going to break in a new way when they decide to turn ciphers back on...

Tags: , , , , ,

18 Responses:

  1. foo says:

    Is http://www.youtube.com/html5 what you're looking for?

  2. Jim Meier says:

    For HTML5, point the browser at http://youtube.com/html5 and click the button.

    • jwz says:

      I did that, and it says I'm "in the trial" but it's still giving me the flash player. Safari and Firefox, logged in or not, caches cleared.

  3. Bill Paul says:

    My impression, which is based only on viewing the occasional video (and which is thus highly unscientific and almost certain to draw your "you're not really helping" ire), is that HTML5 viewing is already selected automatically if your browser supports it, but there are cases where they will insist on using flash anyway. In particular, it seems they force the use of flash if they want you to make you watch a commercial before letting you see the video. Usually when I get the "you must install flash" nastygram on my FreeBSD box and I go to check the video on Windows, it assaults me with a commercial.

    And to follow up on an earlier comment, this is now becoming just like the "Yahoo! Messenger vs. unofficial clients" war from a few years ago, except that Google has content providers with lots of money egging them on which means that unlike Yahoo! they're probably not going to give up. I'm starting to wonder if they have a "design a youtube cipher" contest going on internally so that they can stockpile a bunch of them and roll a new one out every month or so just to screw with everyone.

    • jwz says:

      So far the ciphers have all been auto-generated from the same set of permutations. Difficulties have been related to parsing the obfuscated JavaScript. But maybe that has changed.

  4. Joseph Boyd says:

    If it helps at all, I get the HTML5 version if I change my user-agent in Safari with "Develop->User Agent->iOS 5.1 -- iPad"

  5. Dan says:

    Using the wonderful Safari plugin ClickToFlash - http://clicktoflash.com It seems that, like the other poster has mentioned, when ads are part of the video or the video is really popular HTML5 doesn't work, I have to choose the "Restore Flash" option. CTF also has the ability to right click and download the video. I realize this won't help to patch youtubedown but you might want ping the author of the extension or just use the plugin instead.

    • Peter Bierman says:

      As another datapoint, I can confirm that ClickToFlash can open the example video into QuickTime player.

  6. Maybe I'm late to this conversation, but is there is a reason why https://github.com/rg3/youtube-dl doesn't work for you?

    I just tried it on the video you linked and it slruped down the mp4 right away. In fact, I haven't yet met a YT video it doesn't work for. IIRC, I've even had success with it on Vimeo.

    • jwz says:

      I wrote mine first, and it has an interface I find much more pleasant. Also, generally he suffers from exactly the same failures I do at exactly the same time, so it doesn't solve any actual problems for me. And I dislike Python.

  7. Perry says:

    A suggestion for a debugging tool going forward -- headless webkit based browsers.

    Either http://phantomjs.org/ or http://jeanphix.me/Ghost.py/ might give you the tools you need to figure out what they're doing quickly in the future. The former makes you use javascript to script the engine (yuck) and the latter uses python (which you already said you don't like, sorry). However, these will let you pretend to be a browser under program control and look at what the javascript is doing without having to make guesses.

  8. ongpot says:

    In my experience Youtube's HTML5 player seems to be only used when it doesn't detect the Flash plugin, so the only reliable way for me to get the HTML5 player is to just disable the Flash plugin. Of course there's a snag. videos with ads won't play and instead will tell you to enable the Flash plugin, but you can get around this by using the embedded player just by replacing "watch?v=" with "embed/" in the youtube url. It's annoying, but it works for me better than most parts of youtube, so meh.