Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
windows users:
cmd
to get a terminal to run commands in (protip: rightclick to paste stuff)python3
with python
in all commandsrun these commands:
python3 -m pip install --user softchat chat-downloader fugashi[unidic]
python3 -m unidic download
download https://ocv.me/stuff/NotoSansCJKjp-Regular.otf into a folder named noto-hinted
in the same place you keep your VOD rips
if you want graphical emotes, see --emote_font
in dependencies
download/convert a youtube VOD automatically with ytdl-tui.py (save it next to the noto-hinted
folder, not inside it), then either doubleclick it or:
python3 ytdl-tui.py youtube.com/watch?v=4dlsbJiEa-U
...or do the downloads/conversion steps manually like this:
python3 -m youtube_dl youtube.com/watch?v=4dlsbJiEa-U
python3 -m chat_downloader --message_groups all -o same-filename.json youtube.com/watch?v=4dlsbJiEa-U
python3 -m softchat -m2 same-filename.json
the json filename should be whatever youtube-dl
decides to use, except replace the extension with .json
(and remember quotes depending on OS)
update to the latest version by running this:
python3 -m pip install --user -U softchat chat-downloader
this does not cover ytdl-tui; to check for ytdl-tui updates, run it and press uu
errors like the following:
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate
symptoms:
note: generally ytdl-tui should handle most of these scenarios, so you could try that first, otherwise read on
let's export your cookies and make them available to chat-downloader and youtube-dl; should dodge captchas, make it possible to donwload members-only stuff, and also fix the recent consent requirement from EU members
[Current Site]
cookies.txt
into your VODs folder (next to the noto-hinted
folder)repeat these steps if it breaks again
if you run chat-downloader manually instead of ytdl-tui
, append these arguments: -c cookies.txt
.
mpv
is the recommended player, however in danmaku mode, you should resample the video to your monitor's FPS.
--vf=fps=120
every timeinput.conf
, which lets you press shift-U to toggle upscaling to 120 fps:
U vf toggle fps=120
input.conf
should be here: ~/.config/mpv/input.conf
input.conf
should be here: %appdata%\mpv\input.conf
additionally, on windows you may need to --vo=direct3d
and not fullscreen for resampling to work -- try the different alternatives in --vo=help
and find one which:
The fonts produced by --emote_font
need to be somewhere your media player can see them (either embedded, or in some autoload folder, or installed as system fonts). Set --emote_install
to install fonts into ~/.config/mpv/fonts/
(Linux/macos) or %appdata%\mpv\fonts
(windows) for local playback using mpv. For other media players, or if you intend to share the subtitles, you should use --embed_files
as each font is specific to that particular subtitle file and they need to be used together.
Override automatically vectorized emotes by creating a ".manual.svg" file in the cache directory. So for the emote UCS9uQI-jC3DE0L4IpXyvr6w_Do6dXuL6LZCQ_AP4-buoDQ
create the file UCS9uQI-jC3DE0L4IpXyvr6w_Do6dXuL6LZCQ_AP4-buoDQ.manual.svg
. This can be used for emotes where the automatic version is of low quality.
Similarly, rather than using --emote_fill
to fill the background of all emotes, you can create an empty file named UCS9uQI-jC3DE0L4IpXyvr6w_Do6dXuL6LZCQ_AP4-buoDQ.bg
to enable bg-fill for just that one emote.
--emote_sz 3
and higher makes things collide (wontfix probably)superchats will display for 2x the time and with inverted colors
moderator messages are emphasized
(larger outline, and prefixed with a ball)
mode 1, sidebar chat, creates a huge amount of subtitle events
which many media players (including mpv) will struggle with
for example, seeking will take like 5sec
you can fix this by muxing the subtitle into the vid:
ffmpeg -i the.webm -i the.ass -c copy muxed.mkv
mode 2, danmaku, will look blurry and/or jerky in most players
unless you have the subtitles render at your native screen res
for example in mpv you could add these arguments:
--vo=direct3d --sub-delay=-2 --vf=fps=90
replace 90 with your monitor's fps
after an upgrade, you can reconvert old rips like this:
grep -lE '^Title: .*softchat' -- *.ass | tr '\n' '\0' | xargs -0rtl python3 -m softchat -m2 --
youtube VOD chatlogs are incomplete (about 80% of messages are lost)
so softchat can now take multiple chat JSONs to splice together:
it is recommended to run chat_replay_downloader.py twice,
first when the stream is live and then afterwards for the VOD chat;
when running softchat, the VOD json should be the first file provided,
followed by any live recordings to splice messages from
on windows, --kana
requires python 3.8 or newer
on macos, --kana
is currently busted in macports on sonoma
chatrips must be made using https://github.com/xenova/chat-downloader
a copy of NotoSansCJKjp-Regular.otf
in a folder named noto-hinted
required python libraries: Pillow fontTools
enable --kana
(convert kanji to hiragana) with these:
python3 -m pip install --user fugashi[unidic]
python3 -m unidic download
enable --emote_font
with:
apt install potrace python3-fontforge
port install imagemagick potrace fontforge
note: on windows, cmd must be reopened after installing dependencies
python setup.py rls
FAQs
convert twitch/youtube chat into softsubs
We found that softchat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.