Package: youtube-dl Version: 2017.05.18.1-1 Severity: normal Dear Maintainer,
Recently Trisquel GNU/Linux users discovered that youtube-dl might in some cases execute (as far as I understood) arbitary JavaScript served by the web server it connects to, and thus be harmful for the user. See <https://trisquel.info/en/forum/liberated-version-youtube-dl-almost-here>. Can we somehow work around these JavaScript requirements? At least I think it would be a good thing to warning the user about arbitary JavaScript being run as I, for example, didn't expect that a cli application would run JavaScript. Joonas -- System Information: Debian Release: 9.0 APT prefers stable APT policy: (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.9.0-3-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages youtube-dl depends on: ii dpkg 1.18.24 ii python3 3.5.3-1 ii python3-pkg-resources 33.1.1-1 Versions of packages youtube-dl recommends: ii ca-certificates 20161130+nmu1 ii curl 7.52.1-5 ii ffmpeg 7:3.2.5-1 ii mplayer 2:1.3.0-6 ii rtmpdump 2.4+20151223.gitfa8646d.1-1+b1 ii wget 1.18-5 youtube-dl suggests no packages. -- no debconf information
