This time last year, I was really excited for 2025, to improve the services I run and in trying to find work for myself. Neither really went according to plan. I had a pretty crazy December/January that I won’t bother getting into (real ones know…), and the future was looking alright. Then, I started the year having to find new hosting for my services due to instability of the hosting provider I was with at the time, which was delayed again and again as our previous host kept promising to fix our issues. By the time we could finally get on new hosting, it had been months that my services were unreliable, and I felt pretty miserable for letting my users down. At the same time, I was dealing with the bureaucracy of getting my legal name change done, which took longer than I had hoped.

From ages ~13 to ~17, my personal life was extremely messy, and ironically that made me put way more time into my work as an escape. As things have calmed down in my personal life, I really hoped I’d get to devote even more time to my work, but that hasn’t turned out to be the reality. Turns out spending 4 years oscillating between a chaotic family and school life and then spending all the rest of my time running services so many depend on me for with hardly any time spent on anything else really burned me out! I always dreamed of my 18th giving me freedom, and that I’d escape my current living situation, and somehow find stability elsewhere, and still find time for all the things I manage. Of course, I always kinda knew that was never gonna be reality, and that it’d take more time, but I’d be lying if I said it didn’t get to me a little bit.

I turned 19 last month, and I’ve spent the past few weeks since trying to take better care of myself. I recognise I can’t expect myself at this age to have my life all figured out, so I’m trying to take it slow. Giving myself more routine, getting out a bit more, not to mention getting on better meds— It’s all helped a lot.

Anyway, I’m gonna be doing more work on my services now :) Part-time, cause I’m also looking for a job! Thanks to everyone who’s stuck by me, most of all June, Aly, Ellie, and Aria!

My friend Astra was looking around a decompiled version of Webfishing—giving her access to some of the source code and assets of the game—when she found the profanity list used by the recently-added chat filter. I’ve uploaded this file as a GitHub Gist.

The list is almost entirely what you’d expect. Just a bunch of swears and slurs, exactly what I would want to be blocked if I had a chat filter option turned on. But there are some strange outliers!

Here are just a handful of words which are censored, and probably shouldn’t be. This is almost certainly not everything, this is a pretty big list to sift through!

• arab
• canadian
• ethiopian
• german
• mexican
• palestinian
• israeli
• jewish
• latin
• queer
• gay
• lesbian
• bi (along with “bi-sexual”, but curiously not “bisexual”?)
• my personal favorite, “women’s”

Another interesting quirk is that some words in the list end with a space. This causes them to be completely ignored when filtering words.

How’d that happen?

So, as I said in the disclaimer, I believe this list was certainly just copy-pasted from somewhere online. But where? I don’t actually know where exactly they found it, but I’ve got a pretty big lead. Searching Google for profanity lists, I stumbled upon bad-words.txt, which includes many of these same words. It also includes many more words, though, so Webfishing’s developer either tried to manually sort through the list and didn’t catch enough things, or they found a different version of this list.

The feature was added in the very last update, Patch 1.09, and I don’t doubt it’ll get fixed soon enough :)

I’ve had this discussion a few times now with some fossbro types. Any project under the OQL isn’t considered open source by the Open Source Initiative because it doesn’t allow everyone the same right to use the project. Instead, these projects are technically “source available”, the source code is visible to the public but use is only available under stricter terms.

But I don’t really care what the Open Source Initiative thinks?

I’ve made the source code of my projects available to make the world a better place, not to allow anything I’ve made to be used for evil. If you believe this makes my stuff not technically Open Source, I kinda just don’t care.

“Open Source” is obviously a selling point for projects. I get more excited for a project when I see it’s open source, knowing I’d be allowed to use a project myself and extend it is great. This requirement that a project must be willing to be used for evil to be considered open source just serves to take the ability to promote projects as open source from people like myself.

I’m going to continue to call my projects FOSS whether they’re under the MIT license, AGPL, or OQL. I don’t care that the OSI believes otherwise. The source is available for anyone, and can be used by whoever for anything that isn’t outright evil, and I think that’s all that matters. In the same way that some FOSS projects aren’t allowed to be used without sharing a copy of the license & modifications, my FOSS projects aren’t allowed to be used without having the decency to be an ally.

When you link to something at the end of a Tweet, the link isn’t displayed. Instead, you’ll only see a “summary card” Twitter generates when a post is made. The domain name of the URL is displayed in these cards, so at face value they don’t make phishing easier.

their implementation is Not Perfect

If a link redirects to another page, Twitter follows that redirect and displays the domain name of the destination instead of the original URL. This is fine, it means the cards will reflect the same page users will see. But the user isn’t sent directly to the destination- When someone clicks one of these cards, they go to the original URL. For typical redirect links, that’s okay, because the redirect Twitter experiences will we the same as the user’s redirect. But what if a malicious site serves a different redirect to users than to Twitter?

When Twitter fetches the page content in order to generate these cards, they set the HTTP “User-Agent” header to begin with “Twitterbot/”, so it can be detected on our website that the request was for Twitter. Setting custom User-Agents for things like this is normal, it means sites can customise the text of embeds for specific sites if necessary or block Twitter from making these requests if desired, but for malicious sites it also allows us to exploit this issue reliably.

Here’s an example of an ExpressJS route that detects Twitter and redirects to discord.com, while redirecting to example.com for everyone else:

app.get('/', (req, res, next) => {
	const detectedTwitter = req.headers['user-agent']
		.toLowerCase()
		.startsWith('Twitterbot/')

	if (detectedTwitter) {
		// redirect to the page to be displayed on Twitter
		res.redirect('https://discord.com')
		return
	}

	// handle request for other users
	// malicious sites could serve a phishing site right here
	res.redirect('https://example.com')
})

this issue is old

Twitter has had this issue for years, and I’m by no means the first to notice it. It’s been known since 2019 at the latest. My friend Lexi found the same issue a couple years ago, and she told me it reported this to Twitter through HackerOne, but the exploit still hasn’t been fixed.

BleepingComputer wrote on this in 2019 and contacted Twitter about it, to no response.

BleepingComputer reached out to Twitter for a statement about this problem and if it would be fixed in the near future but received no reply at the time of publishing.

Hopefully Twitter realises the severity of this problem. Be careful when clicking links- the suggestion to check URLs before clicking is a good one, but it’s not infallible!

What if there was a better way?

YouTube’s Content ID is pretty sophisticated. People have tried many, many things to get around it. Various visual effects, like hue-shifting, vignette filters, adding massive coloured borders surrounding the video, and many more have already been tried numerous times. These tricks work sometimes, but YouTube’s Content ID has only gotten better and better at working around these tricks. Any solution needs to make the copyrighted content completely invisible to Content ID, but this very often also means obscuring it for actual human viewers.

But I’ve had an idea in the back of my mind since I saw a video that appeared in my recommendations a couple months ago. It’s a Bad Apple video which can only be viewed in HD. How this works is that 60fps YouTube videos don’t actually play at 60fps unless you view them at 720p or higher, so you can replace every other frame with an entirely black frame and the video will be invisible if you’re not watching with an HD quality setting.

@embed:https://www.youtube.com/watch?v=lwi7ofgZ8ME

What if Content ID doesn’t scan the HD 60fps versions of videos? Would it then be completely oblivious to half of the frames of the video?

This isn’t a good idea. It would make it impossible to watch on low resolutions, harder to compress, makes the video uncomfortable to watch and could even cause watching the video to induce seizures in people with photosensitive epilepsy. This is not a good solution to the problem.

But would it work though?

ffmpeg is a challenge

I didn’t want to extract all the frames and then swap every other one with a black image, I thought that would probably take too long. Instead I looked into ffmpeg’s geq video filter. It allows you to make an expression which is ran per-pixel based on a few variables. ffmpeg also has if and mod functions, so this seemed like it would be a fairly easy task.

ffmpeg -i input.mp4 -y -vf "fps=60,geq=if(mod(N\,2)\,p(X\,Y))" -preset ultrafast output.mp4

Okay, so this doesn’t work how I thought it would. I assumed the color value 0 would be black, but it’s instead some dark muddy green colour? I think this is because ffmpeg is using the YUV color model. I’m not exactly sure how I should get it to use the color black for these frames using a YUV color value, but luckily the geq filter allows me to set expressions for the r, g, and b values of each pixel instead:

ffmpeg -i input.mp4 -y -vf "fps=60,geq=r=if(mod(N\,2)\,p(X\,Y)):g=if(mod(N\,2)\,p(X\,Y)):b=if(mod(N\,2)\,p(X\,Y))" -preset ultrafast output.mp4

To be clear, this command sucks. It’s evaluating the expression on every single pixel in every single frame. I’m positive there are wayyyy better ways to do this, but it was taking me a while to figure this out to begin with so I’m willing to just go with this command for now. If anyone’s figured out a better way to do this in ffmpeg, please do message me!

I’m getting 0.5x speeds out of this at best on my PC. To be fair, this PC’s specs are abysmal, so that wasn’t doing it any favours.

does this actually work

I sent the script off to my friend Aria, who spends An Excessive Amount Of Time archiving media to various places including YouTube.

Really?? This is so stupid. This is completely useless. No way this actually works. I’m running the command on a video real quick to try it out for myself.

Nooooo. I forgot about this. Some shows also do Content ID for the audio of episodes. Even if the video itself is completely undetectable, the video may still get claimed if it contains audio from something. So I’m going to have to do some more alterations to this video to make it get through Content ID.

I think, for this demo, I’ll just put some music over the video. Music gets Content ID too, but music labels tend to not block videos which contain music, instead just taking ad revenue. I’m completely willing to give some music label all the ad revenue for this video so long as it’s visible.

I’m so sorry, but The Family Guy Funny Moments will have to become drained.

family guy funny moments (drained edition) (WARNING: FLASHING LIGHTS)

this has got to be the worst thing i’ve ever made

Drain gang music added to prevent audio claims. Here’s the playlist, lol. Hard-coded subtitles added to make this at least a little bit watchable. All the music I added has gotten detected by Content ID with zero restrictions, and the Family Guy episode itself hasn’t gotten claimed at all. This video can be watched globally. If I was in the YouTube Partner Program I could even earn advertising revenue from this video.

And, in case anyone asks, yes, even with the drain gang music this video gets claimed if I don’t use the strobe effect:

With the strobe effect, the Family Guy Funny Moments are undetected by Content ID.

what have we learned

You can get around YouTube Content ID! As long as you’re willing to ignore these caveats:

• it’s uncomfortable to watch
• causes massive video file size
• requires exporting at 720p or higher at 60fps
• audio can still get claimed so you’ll have to distort that, cover it up with something else, or mute it entirely
• could cause seizures

Please, please don’t start actually using this to evade Content ID. This isn’t a practical solution. Even if this idea were to inspire a more practical Content-ID-evading solution, always remember YouTube will simply patch it if it ever becomes widespread.

I wanted to import my YouTube subscriptions into the open-source Android YouTube client NewPipe. The normal way to do that is to export the subscriptions from Google Takeout, a service Google provides to allow you to retrieve data about your account. NewPipe kindly explains the process:

Excuse the comic sans, it’s my favorite font.

NewPipe’s instructions are as follows:

Import YouTube subscriptions from Google takeout:

1. Go to this URL: https://takeout.google.com/takeout/custom/youtube
2. Log in when asked
3. Click on “All data included”, then on “Deselect all”, then select only “subscriptions” and click “OK”
4. Click on “Next step” and then on “Create export”
5. Click on the “Download” button after it appears
6. Click on IMPORT FILE below and select the downloaded .zip file
7. [If the .zip import fails] Extract the .csv file (usually under “YouTube and YouTube Music/subscriptions/subscriptions.csv”), click on IMPORT FILE below and select the extracted csv file

What they neglect to mention is that Google Takeout can take many hours to complete.

I tried using Google Takeout, but after an hour of waiting, I decided I’d try something else. I would scrape the list of channels I’m subscribed to, and I’d save that list as a CSV file I can import into NewPipe.

Finding out how the Google Takeout CSV is formatted

In order to make my own file that NewPipe would accept as though it were a Google Takeout CSV, I had to find out the format Google Takeout uses.

I found the PR that added the Google Takeout importing support. Inside that commit was a description of the file.

// Expected format of CSV file:
//      Channel Id,Channel Url,Channel Title
//      UC1JTQBa5QxZCpXrFSkMxmPw,http://www.youtube.com/channel/UC1JTQBa5QxZCpXrFSkMxmPw,Raycevick
//      UCFl7yKfcRcFmIUbKeCA-SJQ,http://www.youtube.com/channel/UCFl7yKfcRcFmIUbKeCA-SJQ,Joji
//
// Notes:
//      It's always 3 columns
//      The first line is always a header
//      Header names are different based on the locale
//      Fortunately the data is always the same order no matter what locale

This was simple enough. Now I needed to find out how to get a list of the Channel ID and Channel Title of each of the channels I’m subscribed to.

YouTube scraping

I found a page on YouTube that lists all the channels you’re subscribed to. I got to looking at how this page worked, and realized that the page stores data inside a variable called ytInitialData. This variable stores the list of the channels you’re subscribed to, as well as some other data. YouTube paginates the list, though, so the variable won’t always have everything right off the bat. YouTube loads more of the list whenever you scroll to the bottom of the page, though, which means I can just automate the scrolling.

Another bit of data included in the ytInitialData variable is the API token required to load the rest of the list. And when the list is fully loaded, the token is removed from ytInitialData.

This means I can check if that token exists in order to know whether to keep scrolling down.

I wrote a script to scroll to the bottom of the page by checking the height of the container <div> and then scrolling with the function window.scrollTo.

I then wrote a script to get the Channel IDs and Channel Titles from this list. I would also need the Channel URL, but this was as easy as adding the channel ID after the string "http://www.youtube.com/channel/". It then joined the data of all the channels one by one. Finally, it would log the data to the console.

I combined these scripts and ran them together. It worked.

To make it just a bit more convenient, I made another script which made a <div> to put the CSV data in. This <div> would use position: fixed to cover the screen.

To make it even easier to use, I decided to make a download button to save the text as a file so you wouldn’t need to copy-paste it yourself.

The script

Here’s my code:

function getLast() {
	return ytInitialData.contents.twoColumnBrowseResultsRenderer.tabs[0].tabRenderer.content.sectionListRenderer.contents.slice(
		-1
	)[0]
}
function canContinue() {
	return getLast().continuationItemRenderer != null
}
;(async () => {
	while (canContinue()) {
		let current =
			getLast().continuationItemRenderer.continuationEndpoint
				.continuationCommand.token
		scrollTo(0, document.getElementById('primary').scrollHeight)
		while (
			canContinue() &&
			current ==
				getLast().continuationItemRenderer.continuationEndpoint
					.continuationCommand.token
		) {
			await new Promise(r => setTimeout(r, 100))
		}
	}
	scrollTo(0, 0)
	let floatDiv = document.createElement('div')
	let preText = document.createElement('pre')
	floatDiv.setAttribute(
		'style',
		`position: fixed;
		background: #0f0f0f;
		z-index: 100000;
		inset: 2rem;
		overflow: auto;
		font-size: 2rem;
		white-space: pre;
		color: white;
		padding: 1rem;`
	)
	let csvText =
		'Channel Id,Channel Url,Channel Title\n' +
		ytInitialData.contents.twoColumnBrowseResultsRenderer.tabs[0].tabRenderer.content.sectionListRenderer.contents
			.map(e => {
				if (!e.itemSectionRenderer) return
				return e.itemSectionRenderer.contents[0].shelfRenderer.content
					.expandedShelfContentsRenderer.items
			})
			.flat()
			.map(e => {
				if (e && e.channelRenderer)
					return `${e.channelRenderer.channelId},http://www.youtube.com/channel/${e.channelRenderer.channelId},${e.channelRenderer.title.simpleText}`
				return ''
			})
			.join('\n')
	preText.innerText = csvText
	let downloadLink = document.createElement('a')
	downloadLink.innerText = 'Download CSV'
	downloadLink.setAttribute('target', '_blank')
	downloadLink.setAttribute(
		'style',
		`color: #bf3838;
		font-weight: bold;
		margin-bottom: 1rem;
		display: block;
		padding: 1rem;
		border-radius: 0.5rem;
		border: 2px solid #bf3838;
		width: fit-content;
		text-decoration: none;`
	)
	var t = new Blob([csvText], { type: 'text/plain' })
	downloadLink.href = window.URL.createObjectURL(t)
	floatDiv.appendChild(downloadLink)
	floatDiv.appendChild(preText)
	document.body.appendChild(floatDiv)
})()

You can run this in DevTools at youtube.com/feed/channels. You can then save the file by clicking “Download CSV”.

Conclusion

By the time I had finished writing the script, Google Takeout still hadn’t sent me a download of my subscriptions list. I eventually received this download hours later, but by that point I had already imported my own list into NewPipe and no longer needed theirs.

My guess is that Google Takeout runs on a queue, sending one person their data and then the next, rather than working on each request immediately.

I hope you find my script useful. If you make any improvements, you can let me know in the comments of my GitHub gist about this script.