XPost: alt.comp.software.firefox   
   From: mariasophia@comprehension.com   
      
   Lawrence D¢Oliveiro wrote:   
   > On Sun, 1 Feb 2026 10:09:51 -0500, Maria Sophia wrote:   
   >   
   >> Summary:   
   >>  ii.  Node is most common.   
   >>  iv.  QuickJS works if installed manually.   
   >   
   > Both of these have standard packages available on Debian, and so   
   > should be available in derivatives as well.   
      
   Thanks for adding value for Linux users, especially since the FF ng is   
   involved here, even as it doesn't have much to do with Firefox, per se.   
      
   Here is s'more information about the new "proof-of-origin" checks which   
   yt-dlp is needing the JS engines such as those listed above to download.   
      
   1. What a proof-of-origin check is   
      A. It is a server-side test that tries to confirm that a request really   
         came from a real web browser, not from a script or a downloader.   
      B. YouTube uses it to decide whether to serve a video stream or to   
         block the request with errors such as 403 Forbidden.   
      
   2. How the check works   
      A. YouTube sends JavaScript code that must be executed exactly the way   
         a browser would run it.   
      B. The code computes tokens, signatures or cookies that prove the   
         request originated from a browser-like environment.   
      C. If the JavaScript is not executed correctly, the server refuses to   
         provide the video data.   
      
   3. Why yt-dlp cannot do this alone   
      A. yt-dlp is written in Python, not JavaScript.   
      B. Python cannot run the browser-style JavaScript that YouTube now   
         requires.   
      C. yt-dlp must therefore call an external JS engine to run the code   
         and produce the correct proof-of-origin values.   
      
   4. Why this is new   
      A. For many years YouTube used simpler signature systems that yt-dlp   
         could decode in Python.   
      B. YouTube now uses more complex JavaScript challenges that Python   
         cannot emulate.   
      C. This change began rolling out in late 2025 and continues to expand.   
      
   5. What the check accomplishes   
      A. It slows down automated scraping.   
      B. It forces tools like yt-dlp to behave more like real browsers.   
      C. It lets YouTube rotate or update the challenge without warning.   
      
   6. Summary   
      A. A proof-of-origin check is YouTube asking the client to run real   
         JavaScript to prove it is a browser.   
      B. yt-dlp must use Deno, Node, Bun or QuickJS to run that JavaScript.   
      C. Without a JS engine, the proof cannot be generated so extraction   
         fails.   
      
   This is, I believe, the fundamental cause of the "403 Not Found" errors.   
   --   
   Had I known how it works, I would have written up a tutorial instead since   
   I'm a rare breed of person who delights in edifying everyone around me.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)