selfish yt-dl dmca drama

Karl gmkarl at
Sun Oct 25 13:56:01 PDT 2020

On Sun, Oct 25, 2020 at 4:31 PM Punk-BatSoup-Stasi 2.0 <punks at> wrote:
> On Sun, 25 Oct 2020 15:52:25 -0400
> Karl <gmkarl at> wrote:
> >  As punk half-asserts, signed tarballs (which have source code
> > but not history) are still available at
> >
>         yeah I assumed the tar.gz file has the source, but I just noticed that its size is 1.5 megs - it used to be 3.something megs. I have a youtube-dl-2019.12.25.tar.gz file that is 3.2 megs. I stupidly didn't keep anything newer than that.
> > which is a blessing, although it seems
> > there are even better solutions kicking around.

Yeah, when I try to actually download the 1.5 meg tarball, I get an
error about an expired SSL certificate, and after download via that
expired certificate it has an sha256sum that doesn't match the one on
the website, if it matters.  Lots of python files, though.

Icing on the cake, the signature doesn't verify!  That's always exciting.

$ sha256sum youtube-dl-2020.09.20.tar.gz*
$ gpg --verify youtube-dl-2020.09.20.tar.gz.sig
gpg: Signature made Sun 20 Sep 2020 01:32:08 AM EDT using RSA key ID 18A9236D
gpg: BAD signature from "Sergey M. <dstftw at>"
$ wc -c youtube-dl-2020.09.20.tar.gz*
1481717 youtube-dl-2020.09.20.tar.gz
    566 youtube-dl-2020.09.20.tar.gz.sig
1482283 total

My email to you doesn't even have a signature, so it has likely changed too.

More information about the cypherpunks mailing list