XPost: alt.comp.software.firefox   
   From: mariasophia@comprehension.com   
      
   Maria Sophia wrote:   
   >    A. Your system has not hit the new challenge again yet.   
   >    B. Because the requirement is real and will return.   
   >    C. Installing a JS engine such as deno.exe remains the long-term fix.   
      
   In another thread I wrote this, which I post to keep it all together for   
   the records so that folks years from now can still benefit from our   
   efforts.   
      
   Here is s'more information about the new "proof-of-origin" checks which   
   yt-dlp is needing the JS engines such as those listed above to download.   
      
   1. What a proof-of-origin check is   
      A. It is a server-side test that tries to confirm that a request really   
         came from a real web browser, not from a script or a downloader.   
      B. YouTube uses it to decide whether to serve a video stream or to   
         block the request with errors such as 403 Forbidden.   
      
   2. How the check works   
      A. YouTube sends JavaScript code that must be executed exactly the way   
         a browser would run it.   
      B. The code computes tokens, signatures or cookies that prove the   
         request originated from a browser-like environment.   
      C. If the JavaScript is not executed correctly, the server refuses to   
         provide the video data.   
      
   3. Why yt-dlp cannot do this alone   
      A. yt-dlp is written in Python, not JavaScript.   
      B. Python cannot run the browser-style JavaScript that YouTube now   
         requires.   
      C. yt-dlp must therefore call an external JS engine to run the code   
         and produce the correct proof-of-origin values.   
      
   4. Why this is new   
      A. For many years YouTube used simpler signature systems that yt-dlp   
         could decode in Python.   
      B. YouTube now uses more complex JavaScript challenges that Python   
         cannot emulate.   
      C. This change began rolling out in late 2025 and continues to expand.   
      
   5. What the check accomplishes   
      A. It slows down automated scraping.   
      B. It forces tools like yt-dlp to behave more like real browsers.   
      C. It lets YouTube rotate or update the challenge without warning.   
      
   6. Summary   
      A. A proof-of-origin check is YouTube asking the client to run real   
         JavaScript to prove it is a browser.   
      B. yt-dlp must use Deno, Node, Bun or QuickJS to run that JavaScript.   
      C. Without a JS engine, the proof cannot be generated so extraction   
         fails.   
      
   This is, I believe, the fundamental cause of the "403 Not Found" errors.   
   This begs the question of what a JS engine is, in terms of yt-dlp needs.   
      
   1. What a JS engine is   
      A. It is a program that reads and executes JavaScript code.   
      B. Web browsers contain JS engines, for example Chrome uses V8 and   
         Firefox uses SpiderMonkey.   
      C. A standalone JS engine runs JavaScript outside a browser, which is   
         what yt-dlp needs for YouTube's new challenges.   
      
   2. What a JS engine does   
      A. It parses JavaScript text into instructions the computer can run.   
      B. It executes that code the same way a browser would.   
      C. It produces values, tokens or signatures that the server expects.   
      
   3. Why yt-dlp needs one   
      A. YouTube now sends JavaScript that must be executed exactly.   
      B. Python cannot run that JavaScript.   
      C. yt-dlp calls an external JS engine to run the code and return the   
         proof-of-origin values.   
      
   4. Examples of JS engines   
      A. Deno, a single portable EXE.   
      B. Node.js, a full installation.   
      C. Bun, a newer runtime.   
      D. QuickJS, a small standalone engine.   
      
   5. Summary   
      A. A JS engine is simply a program that runs JavaScript.   
      B. yt-dlp uses it to solve YouTube's new browser-like challenges.   
      
   That then begs the question of why doesn't everyone see the same errors.   
   This is the classic YMMV case since results depend on YouTube algorithms.   
      
   1. These are possible reasons why yt-dlp might work without a JS engine   
      A. YouTube does not apply its JS proof-of-origin checks to all users.   
         Some regions, IP ranges or accounts do not receive the challenge.   
      B. yt-dlp can still use older extraction paths when the JS challenge   
         is not triggered. These include cached signatures and older logic.   
      C. A recent yt-dlp update may have added new extraction patterns that   
         temporarily bypass the need for a JS engine.   
      D. YouTube sometimes rolls back new anti-bot code when it causes   
         problems. If that happened in your region, extraction may work   
         again without JS.   
      E. Not all videos require JS-based signature checks. Older videos or   
         videos on certain CDNs may still work with pure Python logic.   
      
   2. What this means   
      A. yt-dlp can appear to work normally even when no JS engine is   
         installed.   
      B. This does not mean the new JS requirement is gone. It only means   
         our requests have not triggered the new challenge recently.   
      C. The yt-dlp developers have stated that a JS runtime will become   
         necessary for reliable long-term YouTube extraction.   
      
   3. Summary   
      A. Your system has not hit the new challenge again yet.   
      B. Because the requirement is real and will return.   
      C. Installing a JS engine such as deno.exe remains the long-term fix.   
   --   
   Had I known how it works, I would have written up a tutorial instead since   
   I'm a rare breed of person who delights in edifying everyone around me.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)