Another day, another cipher change

Well, Youtube broke youtubedown again, and I haven't yet figured out how. Today's cipher is 'vfl-bxy_m' => 'w48 s3 w37 s2', and my Perl code seems to be doing the same thing as the Javascript code's function lj and mj, but it's not working. That algorithm is mapping to a 76 byte string with no period in the middle, which is not typically what they look like, so there must be some new kink somewhere. (Same old sample video.)

Any ideas?

How do you get Safari, Firefox or Chrome to switch to the HTML5 player instead of the Flash player, anyway? I think there used to be a link on the page for that but I don't see it now.


Update: I figured it out. This time, they seem to have actually turned off enciphered signatures, but the "use_cipher_signature" parameter is still True. I guess they don't actually use that. So the only way to tell is to see whether the url_map is using s= instead of sig=. Fun times. I was deciphering sigs that were already deciphered. I wonder if this is going to break in a new way when they decide to turn ciphers back on...

Tags: , , , , ,

18 Responses:

  1. foo says:

    Is what you're looking for?

  2. Jim Meier says:

    For HTML5, point the browser at and click the button.

    • jwz says:

      I did that, and it says I'm "in the trial" but it's still giving me the flash player. Safari and Firefox, logged in or not, caches cleared.

      • foo says:

        With HTML5 enabled, I'm served the flash player for some videos but not others.

        • Jim Meier says:

          As mentioned below, they seem to force flash playback to show ads. Turn on an adblocker and see if that helps?

          • Otto says:

            It doesn't. You can block the ads with a proper adblocker, but it will still give you the flash player in order to attempt to show them.

      • phessler says:

        videos with ads require the flash player, they don't work with html5 just yet.

  3. Bill Paul says:

    My impression, which is based only on viewing the occasional video (and which is thus highly unscientific and almost certain to draw your "you're not really helping" ire), is that HTML5 viewing is already selected automatically if your browser supports it, but there are cases where they will insist on using flash anyway. In particular, it seems they force the use of flash if they want you to make you watch a commercial before letting you see the video. Usually when I get the "you must install flash" nastygram on my FreeBSD box and I go to check the video on Windows, it assaults me with a commercial.

    And to follow up on an earlier comment, this is now becoming just like the "Yahoo! Messenger vs. unofficial clients" war from a few years ago, except that Google has content providers with lots of money egging them on which means that unlike Yahoo! they're probably not going to give up. I'm starting to wonder if they have a "design a youtube cipher" contest going on internally so that they can stockpile a bunch of them and roll a new one out every month or so just to screw with everyone.

    • jwz says:

      So far the ciphers have all been auto-generated from the same set of permutations. Difficulties have been related to parsing the obfuscated JavaScript. But maybe that has changed.

  4. Joseph Boyd says:

    If it helps at all, I get the HTML5 version if I change my user-agent in Safari with "Develop->User Agent->iOS 5.1 -- iPad"

  5. Dan says:

    Using the wonderful Safari plugin ClickToFlash - It seems that, like the other poster has mentioned, when ads are part of the video or the video is really popular HTML5 doesn't work, I have to choose the "Restore Flash" option. CTF also has the ability to right click and download the video. I realize this won't help to patch youtubedown but you might want ping the author of the extension or just use the plugin instead.

  6. Maybe I'm late to this conversation, but is there is a reason why doesn't work for you?

    I just tried it on the video you linked and it slruped down the mp4 right away. In fact, I haven't yet met a YT video it doesn't work for. IIRC, I've even had success with it on Vimeo.

    • jwz says:

      I wrote mine first, and it has an interface I find much more pleasant. Also, generally he suffers from exactly the same failures I do at exactly the same time, so it doesn't solve any actual problems for me. And I dislike Python.

  7. Perry says:

    A suggestion for a debugging tool going forward -- headless webkit based browsers.

    Either or might give you the tools you need to figure out what they're doing quickly in the future. The former makes you use javascript to script the engine (yuck) and the latter uses python (which you already said you don't like, sorry). However, these will let you pretend to be a browser under program control and look at what the javascript is doing without having to make guesses.

  8. ongpot says:

    In my experience Youtube's HTML5 player seems to be only used when it doesn't detect the Flash plugin, so the only reliable way for me to get the HTML5 player is to just disable the Flash plugin. Of course there's a snag. videos with ads won't play and instead will tell you to enable the Flash plugin, but you can get around this by using the embedded player just by replacing "watch?v=" with "embed/" in the youtube url. It's annoying, but it works for me better than most parts of youtube, so meh.

  • Previously