Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

The problem is that advertisement business infects everything.

For instance, I could pay for Youtube Premium to ostensibly not be shown ads, but it doesn't change the fact that all the content[^1] in the ecosystem is still produced for maximizing watch time and/or being advertisement friendly.

I could pay for news, but that doesn't change the fact that the news is written to receive clicks from the non-paying users.

Paying for things does not help escaping the second order effects of advertisement.

[^1]: To a close approximation.

Every one of the streaming services that I paid extra to go ad free decided to push ads anyway.

Paying make it worse, paying doesn't prevent ads to be forced later (e.g: Netflix, Prime, Disney+) and split people fight against ad, as the ones with enough money to avoid them will berate the other for not paying, will still providing benefits to an ad-driven company.

Never pays to avoid ad, block them or get the content by other means. It's akin to "never negotiate with terrorists" or "never pay ransom", you have to remove the incentive.

I know that I, as a user, ultimately have 2 choices: to pay for a subscription, or the choice to not use these services.

Option (1) does not block infinite scrolling content, it only removes adds. So this is missing the point. All i want is to not see these dumb shorts videos that I genuinely give no fuck about, but that manages to catch my attention regardless.

Then sure, I can always delete my social accounts, and ultimately i might end up doing it. But let me try to explain why I think this is difficult, and also unfair.

I give 2 purposes to these social networks: First, they play a role in personal-life balance as a way to be more integrated in my group of friends / local communities. Second, they play a role as citizen of my region (in my case, France and switzerland) by being a (sorta reliable) source of information through following accounts and newspapper on them.

Initially, none of these social-networks came with this super-fast / addictive content. They only started to integrate it, in my experience, since 5 years. So it seems to me that these companies have broke the initial contract that they "sold" to us: to connect with our friends & communities and to allow us to follow a specific set of public influencers.

I guess that I am mad that we, as a society, have allowed these companies to gain such an important role in our daily lifes (social life and public life) that they can now say : we will allow you to interact with some of our friends, but you will also have to watch our stupid videos... And unfortunaltey, it's not easy at all to spin up a concurrent social networks that would be full-filling this initial contract. Probably lots of people actually like to scroll on insta Reels and youtube Shorts.

For web access, in Firefox I've been using the "SocialFocus" add-on, that allows you to remove certain blocks in "social" websites (for example, blocking Shorts or comments in YT), put a color filter to make it "black and white", or even blocking the whole site. I had to access Facebook a couple times some months ago, and the quantity of trash you can filter with this add-on is astounding. This developer has also a YouTube specific add-on I haven't tested yet, named "UnTrap for YouTube" that has almost 200 different options for blocking very specific stuff there. Their add-ons in [0]

For Android there's an App called Revanced that let's you apply patches on certain commercial apps like YouTube or Twitter modifying their behavior, and for example block shorts. See the patches available for YouTube in [1]. I'm still pending to test it, but if you do, go to their official site [2], or even better, to their GitHub releases [3] as it seems like there are a good bunch of scammy sites using their name.

--

  0: https://addons.mozilla.org/ru/firefox/user/17777732/
  1: https://revanced.app/patches?pkg=com.google.android.youtube
  2: https://revanced.app/
  3: https://github.com/ReVanced/revanced-manager/releases

Wouldn't risk trying to extract from IG too much, I used to yt-dlp from it a lot and use scripts to extract the images because I like to archive references, nothing on a massive scale we're talking <20 times a month and I got a warning that I could lose my username if I "use automated scraping tools".

It's 11 years old, I'm impressed that it even works.

I'm not going to trust that until its on F-Droid.

Imo the best thing that can work is introducing delays to the loading of videos, increasing as time goes by. Youtube introduced sth like this to me, when they were presumable trying "punishing" users with adblockers, and it worked as a charm to get me disengage from the youtube rabithole. A lot of such addiction dynamics work based on how fast getting the reward is, and these interuptions disturb this.

Until the company decides to unilaterally reenable that setting to "help you get more from their service".

That's not persistent :(

Youtube have been gradually cracking down on yt-dlp by blocking IPs that download (presumably without watching the adverts, or some other method to fingerprint it). Currently it's mostly annoying as I have to rotate through IPs every few days. But I imagine it'll get worse and worse until I stop watching youtube.

Pretty sure it's only gonna get deleted if either a) enough people use it so that a MBAs notice or b) the way it's accessing the data blocks a feature that an MBA wants

Or just use a localhost invidious instance.

Smoothly handling missing or unexpected fields is half the value proposition of protobuf. May as well switch a a much simpler versioned binary protocol instead of all this schema and field tagging complexity if you want to reject every message that doesn't match the client's schema.

And rejecting unknown messages would likely degrade the user experience. Just because Google releases a new version doesn't mean everyone instantly has that new version installed everywhere.

Certificate pinning would be a solution, but the world seems to have decided that that's very difficult to get right too. Probably easier to get right in an app than in a website, but I understand not using it.

They could manually sign the protobuf messages to ensure integrity. Duplicating some of the work TLS would already do, but doing it decoupled from TLS infrastructure may be easier.

But unless something like OP's hack becomes mainstream, Google's current approach could be the right one. Sure, it leaves them open to message manipulation, but the potential lost ad revenue from even a tiny failure rate around update time from the other approaches could easily outweigh what they lose from a handful of people running middleware boxes to block ads.

"We're sorry for any inconvenience this error may have caused"

Why would anyone want this fixed?

[dead]

This, and the fact that a fair bit of this would 'come for free' due to tvOS being based on iOS which has supported custom CAs for ages.

Starting with Android 7, apps have to opt into user-installed certificates. Browsers often do (Firefox is an annoying exception, you need to turn it on in the dev settings and it doesn't work in the official release version of the browser), but apps usually don't even know that the setting exists.

Aside from that, Android has a very easy certificate pinning API where you can just assign a fingerprint to a domain name in the XML config files and it'll pin a certificate to that domain. Easy to bypass if you modify the APK file, but then you miss out on updates and other mechanisms could check if the signature has been tampered with.

With root access (shouldn't be too hard to gain on an Android device still running 7) you can add your certificate to the root certificate folder on the system partition. This will make Let's Encrypt work on all apps. It doesn't bypass certificate pinning, of course, but you don't need there for Let's Encrypt.

That sounds like you've just made it so your app doesn't work behind a corporate SSL proxy. I really need people to stop rolling there own SSL stores (looking at you python, java and nodejs). I spend way to much of my time getting things running on my work laptop that should just use the CA store IT pre-installed.

> but almost all apps nowadays use certificate pinning which means the system certificate store is ignored

Certificate pinning (or rather, public key pinning) is technically obsolete and browsers themselves removed support for it in 2018. [1] Are there many apps still really using this?

[1]: https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning

> I find it extremely surprising that YouTube doesn’t do that.

Not surprising for me - it used to be only banks where it was required (sometimes by law) that any and all communication be intercepted and logged, but this crap (that by definition breaks certificate pinning) is now getting rolled out to even small businesses as part of some cyber-insurance-mandated endpoint/whatever security solution.

And Youtube is obviously of the opinion that while bankers aren't enough of a target market to annoy with certificate pinning breaking their background music, ordinary F500 employees are a significant enough target market.

> Supposedly creators get a bigger share from YT Premium users'

I've heard this multiple times before, but every time I go hunting for a source from Google/YouTube, I cannot find any official statements or confirmed information about this, seems this is mostly based on 3rd party analysis afaik.

> watching their videos ad-blocked provides nothing.

it provides the view count, for which the creator reaps rewards from as part of the boost in the algorithm from youtube.

Not to mention that a lot of creators on youtube also do sponsored segments.

They get far more from a premium viewer than an ad viewer.

Also, Infuse, which is a nice app for playing video files over the network and support Jellyfin, Plex, and others. It also have Dolby and DTS decoders, which works great as the box only have PCM output.

Typing a youtube/netflix search box with a remote seems harder to me than doing it comfortably on a decent keyboard.