Windows executable no longer works when ran at low integrity

[TheRyuu]

The official windows executable (youtube-dl.exe created with py2exe) no longer works correctly when ran at a low integrity level. I've been running it at a low integrity level for quite some time now in combination with mpv which also works fine as neither require any write access.

My common use case is the following:

PsExec.exe -d -l mpv.exe --ytdl youtube/twitch-url-here

With more recent versions of youtube-dl the following error occurs:

The last working version I believe is the 2015.10.18 build (yes this has been broken for quite some time now I just haven't gotten around to making the ticket till now). I couldn't really find anything that would suggest this would stop working in the commit log so maybe something changed with the py2exe building.

I realize that most people probably don't care about this but I do think that it's a useful and attractive feature that the youtube-dl + mpv combination provide. I can provide additional information if needed. This is on Windows 8.1 Update 3 64-bit.

[Hrxn]

I'm not sure if I understand it correctly..

Did you build your youtube-dl.exe with py2exe yourself?

[TheRyuu]

No the official builds.

[Hrxn]

Ah, okay. So the low integrity mode is the culprit. I agree with you, I don't see why it shouldn't work with low integrity, theoretically. But theory is one thing and..

What is the benefit of low integrity level here? After all, this are some binaries you can trust, I'd say ;-)

[TheRyuu]

It's not about trusting binaries, it's about the data they work on. mpv and youtube-dl are connecting to the internet so they're working on untrusted data exclusively in this case.

[dstftw]

Post the output of youtube-dl -v youtube/twitch-url-here.

[yan12125]

Confirmed with the following command:

C:\Users\yen\Desktop>PsExec.exe -l cmd

In the newly opened cmd, run:

C:\Users\yen\Desktop>youtube-dl.exe
Traceback (most recent call last):
  File "__main__.py", line 19, in <module>
  File "youtube_dl\__init__.pyo", line 410, in main
  File "youtube_dl\__init__.pyo", line 377, in _real_main
  File "youtube_dl\YoutubeDL.pyo", line 342, in __init__
  File "youtube_dl\YoutubeDL.pyo", line 1982, in _setup_opener
  File "youtube_dl\utils.pyo", line 503, in make_HTTPS_handler
  File "ssl.pyo", line 440, in create_default_context
  File "ssl.pyo", line 391, in load_default_certs
  File "ssl.pyo", line 378, in _load_windows_store_certs
WindowsError: [Error 5] Access is denied

C:\Users\yen\Desktop>

With PsExec 2.11.

[Hrxn]

It's not about trusting binaries, it's about the data they work on. mpv and youtube-dl are connecting to the internet so they're working on untrusted data exclusively in this case.

You are obviously right here, but truth be told, I've never heard of a case so far.

This could be an issue, potentially, but it boils down to what links/sites you run youtube-dl against.

Open any new/unknown/dubious link in a browser first, for example..

[yan12125]

Ref: It's actually a Python bug http://bugs.python.org/issue25939. However, youtube-dl should have a workaround. For example, --no-check-certificate should work in such cases.

[Kagami]

This issue seems to be fixed in 3.4 and 3.5 branches: https://bugs.python.org/issue25939#msg260429
Any plans to update Python for Windows builds?

[yan12125]

First we should wait until the next stable release of Python. Seoncd there's currently no plan to build Windows binary against Python 3.x due to some reported failures. See comments in #5094. And py2exe does not support Python 3.5 or later, so 3.4 is the only option.

It's not a good news that my patch is not applied to 2.7 branch. I've asked them.

[Kagami]

If I understand everything correctly, latest youtube-dl for Windows is built against Python 2.7.10, so using --no-check-certificate should be sufficient?

[yan12125]

latest youtube-dl for Windows is built against Python 2.7.10

Yes

using --no-check-certificate should be sufficient

Unfornately no - old Python fails before no_check_certificates takes effect because certificates are always loaded when creating an SSL context. Disabling checking occurs after the context is created. A workaround cab be porting create_default_context() of ssl.py but I don't think it's a good idea.

[Hrxn]

Looks like py2exe has not been updated in a while, let's hope it soon will be.

[yan12125]

A good news from Python.org: https://bugs.python.org/issue25939#msg260901. I'll keep this ticket open until Python 2.7.12 released.

[yan12125]

Python 2.7.12 is released, closing. Note that the official youtube-dl.exe is now built against Python 3.4.4 and does not include the upstream fix. You'll need to install either Python 2.7.12 of Python 3.5 in this case. See #10014 for more further discussion.