Re: (was Re: Adding a description text property for a track) non-free javascript and ytdl

[Yuchen Pei]

On Thu 2022-03-17 11:17:13 -0400, Yoni Rabkin wrote:

> I realized that I don't know a lot about ytdl/youtube-dl and went to
> have a look. As a result, I came across a potential show-stopper for
> inclusion in Emms in any form.
>
> I was concerned when I saw that ytdl/youtube-dl has a javascript
> interpreter built-in.

If there were no mpv binding for emms, a proposal to add it would be
rejected based on the same ground, because mpv by default supports
playing all the urls supported by ytdl, through ytdl.

So when emms plays a youtube video through mpv, it calls mpv, which
calls youtube-dl / yt-dlp, which may execute js when streaming the
video, free or nonfree.

By contrast, I highly doubt the emms-info-ytdl would actually indirectly
execute any js.  It calls youtube-dl -j (getting the json, as opposed to
streaming), which probably only retrieve the metadata using a json
parser and stops there without executing any js code, something like the
command in [1], which youtube-dl youtube extrator runs some equivalent
python code to get video formats, among other things.

[1] https://lists.gnu.org/archive/html/emms-help/2022-03/msg00025.html

So in conclusion, emms-info-ytdl is probably harmless, and definitely
less harmful than the emms mpv binding, if judged by the js execution.

>
> I found the following thread that reports that ytdl/youtube-dl downloads
> and runs non-free javascript automatically as part of accessing the
> sites it supports:
> https://trisquel.info/en/forum/do-youtube-dlhtml5-video-everywhere-run-nonfree-js
>
> The thread is from back in 2017. Is this still the case? If so, is there
> a libre version of ytdl?


Best,
Yuchen

-- 
PGP Key: 47F9 D050 1E11 8879 9040  4941 2126 7E93 EF86 DFD0
          <https://ypei.org/assets/ypei-pubkey.txt>