YouTube: Sign in to confirm you’re not a bot

[robinfriedli]

Looks like YouTube have come up with something new, every track now fails with ;Sign in to confirm you’re not a bot.

Unfortunately I do not have a stack trace / more information yet. Lavaplayer reports it as common error and I do not log more information for common errors. The error only occurs in production, works fine locally, I assume YouTube flags your IP but I already am rotating a /48 subnet.

[devoxin]

I assume you're using a versioned release (such as 1.3.0). Could you try the latest commit from the patch/drop-cookies branch, which prevents the storing of cookies set by YouTube, which should make it a little more difficult to identify IP addresses within a block as being used by the same client.

implementation("dev.lavalink.youtube:<MODULE>:b2c8c070cdc4caa1fa93d0d7ac3f9d468bfa27a8-SNAPSHOT")

[robinfriedli]

Yup, using b2c8c070cdc4caa1fa93d0d7ac3f9d468bfa27a8-SNAPSHOT fixes it, thanks

[robinfriedli]

Actually, I spoke to soon, broken again.

[devoxin]

What clients are you using?

[robinfriedli]

Btw, I'm using a /48 subnet for rotation. Not sure if YouTube would ban such a huge range or if it's some of the /64 subnets within that range that get banned.

What clients are you using?

Just default, so new Music(), new Web(), new Android(), new TvHtml5Embedded()

[devoxin]

Can you try any of the other clients (ANDROID_TESTSUITE is the only other client that receives opus formats fwiw)? Who is the provider of your /48? And what is your rotation strategy?

[robinfriedli]

hurricane electric and RotatingNanoIpRoutePlanner

[robinfriedli]

Probably unrelated, but is providing a username and password for age restricted videos not a thing anymore?

[robinfriedli]

I've added the AndroidTestsuite client and it does not seem to have changed anything

[devoxin]

Could be your IP block is flagged. Maybe the cookie thing is a solution but won't have any effect until your IPs are un-flagged

Probably unrelated, but is providing a username and password for age restricted videos not a thing anymore?

Correct. There were security concerns and a lot of code required to support that, and it was beginning to break so it was not kept.

[robinfriedli]

Yeah it's probably that. My server that uses the hurricane electric tunnel seems fine actually, it's just my other server that has a /48 from galaxygate that has this problem

[devoxin]

So from what I'm gathering after a bit of investigative work, YouTube is identifying large amounts of traffic from certain providers which is causing them to challenge requests originating from the ASNs of those providers. You could try rotate over a block larger than a /48 or switch to a provider who is not commonly used for music bots and the like but I can't guarantee how long this workaround would last.

The only other alternative is to reimplement account authentication but I'm not super enthusiastic about this given the amount of code required to support this, and there's no telling what YouTube will do in the future, whether they start banning accounts associated with bot traffic or restricting their ability to stream unchallenged. Additionally, there were security concerns with the old method of logging into accounts that would very much need to be addressed if this was to be reimplemented as a feature.

[MassKlaus]

Would something like the grayjay app implementation of the youtube authentication help? Theirs is written in javascript but could be still useful

[Guerteltier]

https://wolfdo.gg/notes/9u8nslrsqhe3xis5

[Marvinzock34]

Well i also have the same issue on my Rasperry pi and my Debian server but not on my Win 10 pc on my pc it works fine

[robinfriedli]

Btw, my server has not been unflagged yet, seems unlikely this one's temporary (until you sign in that is)

[devoxin]

Certain ASNs are flagged. It's likely to remain flagged as long as there's suspicious traffic, or perhaps even forever if it's a popular server host (such as OVH).

[robinfriedli]

I've disabled the server since it got flagged, just launched a test instance of my bot to check. The affected server has a galaxygate /48, not sure if they are popular enough for youtube to care. Ironically the other server using a /48 from tunnelbroker is fine, would expect youtube to me more suspicious about that one. It does seem like youtube just keeps you flagged until you sign in

[tylerrun1]

I'm using the 1.4.0 latest version and now this issue is likely to happen once more

Load failed

com.sedmelluq.discord.lavaplayer.tools.FriendlyException: This video requires login.
        at dev.lavalink.youtube.clients.skeleton.Client.getPlayabilityStatus(Client.java:91) ~[youtube-plugin-1.4.0.jar!/:na]
        at dev.lavalink.youtube.clients.skeleton.NonMusicClient.loadTrackInfoFromInnertube(NonMusicClient.java:98) ~[youtube-plugin-1.4.0.jar!/:na]
        at dev.lavalink.youtube.clients.skeleton.NonMusicClient.loadVideo(NonMusicClient.java:319) ~[youtube-plugin-1.4.0.jar!/:na]
        at dev.lavalink.youtube.YoutubeAudioSourceManager.lambda$routeFromVideoId$6(YoutubeAudioSourceManager.java:309) ~[youtube-plugin-1.4.0.jar!/:na]
        at dev.lavalink.youtube.YoutubeAudioSourceManager.loadItemOnce(YoutubeAudioSourceManager.java:185) ~[youtube-plugin-1.4.0.jar!/:na]
        at dev.lavalink.youtube.YoutubeAudioSourceManager.loadItem(YoutubeAudioSourceManager.java:151) ~[youtube-plugin-1.4.0.jar!/:na]
        at com.sedmelluq.discord.lavaplayer.player.DefaultAudioPlayerManager.checkSourcesForItemOnce(DefaultAudioPlayerManager.java:406) ~[lavaplayer-1.5.4.jar!/:na]
        at com.sedmelluq.discord.lavaplayer.player.DefaultAudioPlayerManager.checkSourcesForItem(DefaultAudioPlayerManager.java:388) ~[lavaplayer-1.5.4.jar!/:na]
        at com.sedmelluq.discord.lavaplayer.player.DefaultAudioPlayerManager.lambda$createItemLoader$0(DefaultAudioPlayerManager.java:183) ~[lavaplayer-1.5.4.jar!/:na]
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[na:na]
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[na:na]
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[na:na]
        at java.base/java.lang.Thread.run(Thread.java:840) ~[na:na]
        Suppressed: com.sedmelluq.discord.lavaplayer.tools.exception.EnvironmentInformation:

[Midorina]

I'm having a similar issue:

{'message': 'Sign in to confirm you’re not a bot', 'severity': 'common', 'cause': 'com.sedmelluq.discord.lavaplayer.tools.FriendlyException: Sign in to confirm you’re not a bot'}

Ipv6 rotation is enabled.