Alessandro Pogliaghi's Blog

Forking MeTube ~ You can just do stuff

apogliaghi@gmail.com (Alessandro Pogliaghi) — Sun, 04 Jan 2026 00:00:00 +0000

The Itch

MeTube is a neat self-hosted YouTube downloader with a clean web UI. Paste a link, pick your format, hit download. Simple.

Except YouTube decided that simple things shouldn’t stay simple.

At some point, downloads started failing with the lovely “Sign in to confirm you’re not a bot” message. Classic. YouTube’s bot detection had gotten stricter, the web is not fun anymore.

On top of that, I wanted my downloaded videos to actually show up properly in Jellyfin instead of appearing as mysterious “Unknown” entries with no metadata. Two itches, one fork.

MeTube POT interface

POT (Proof-of-Origin) Support

YouTube’s anti-bot measures work by requiring a “Proof-of-Origin” token, basically proving that the request comes from a legitimate browser session rather than some script hammering their servers.

The fix? bgutil-ytdlp-pot-provider. It’s a yt-dlp plugin that generates these POT tokens, making YouTube believe the requests are coming from an actual browser.

Jellyfin Integration

Video properly displayed in Jellyfin with full metadata

Here’s the thing about downloading YouTube videos: yt-dlp can grab a ton of metadata and save it as a .info.json file alongside the video. Title, description, upload date, channel name, tags, duration, everything.

Jellyfin, however, doesn’t speak .info.json. It wants .nfo files, an XML format that media servers have used since the Kodi days.

So I wrote a post-processor hook that runs after each download completes.

It reads the .info.json, extracts the relevant fields, and generates a Jellyfin-compatible .nfo file. The metadata mapping looks like this:

Title and Original Title from the video title
Plot from the description
Year and Premiered from the upload date
Studio and Director mapped to the uploader/channel
Tags from the video tags (capped at 20 to keep things sane)
Runtime converted from seconds to minutes
Unique ID storing the YouTube video ID

After generating the .nfo, the hook cleans up by deleting the original .info.json. No leftover clutter.

Keeping Up with Upstream

Creating a meme without Nano Banana 🍌? Ain’t nobody got time for that!

Forking is easy. Maintaining a fork? Not so fun.

The upstream MeTube repo keeps getting updates: bug fixes, new features, dependency bumps.

I automated this with a GitHub Action (lame, I know) that runs weekly. Here’s what it does:

Fetches the latest upstream release from the original MeTube repo
Checks if it’s already been analyzed (no point in creating duplicate reports)
Generates a diff between the fork and the new release
Sends the diff to an LLM for analysis because, I ain’t got time for that
Creates a GH issue with the analysis report

The result? A nicely formatted issue telling me whether I should bother merging upstream changes or if I can safely ignore them. The boring parts of fork maintenance, automated.

Use it yourself

The fork lives at tatoalo/metube_pot. If you’re running MeTube and hitting YouTube’s bot detection, or you want your downloads to play nice with Jellyfin, give it a spin:

docker pull ghcr.io/tatoalo/metube_pot

Sometimes you just see something that’s 90% of what you need, and the remaining 10% is an afternoon of hacking. Fork stuff, scratch your own itches, automate the tedious parts.

Note: I don’t condone piracy. Use this tool responsibly and ethically. Also, respect YouTube’s terms of service and copyright laws. 🤷‍♂️

Note: This has been done for fun and for research purposes. 🤷‍♂️🤷‍♂️

Crypto Miner in hotio/qbittorrent

apogliaghi@gmail.com (Alessandro Pogliaghi) — Tue, 23 Sep 2025 00:00:00 +0000

🗣️ Join the Discussion 🗣️

Hacker News 🦞 Lobste.rs

Infected Container Image

Registry: ghcr.io/hotio/qbittorrent
Tag: release
Digest: sha256:3779f89712dbaa8b25fc22897d0b471ee 29049b2b0f8d3c192df83b098c84fc5

Recently, while migrating to a new server, I discovered a suspicious process running inside a hotio/qbittorrent Docker container.

I mainly use this to download Linux ISOs, as anybody else, right?

I just want to get that sweet sweet Omarchy ISO.

The Problem

While monitoring system resources, I noticed a process consuming unusually high CPU:

$ ps -ef | grep netservlet
1000 758679 756435 99 09:39 ? 00:13:43 ./netservlet

The binary netservlet was unfamiliar, and attempts to inspect it via /proc failed:

$ docker exec qbittorrent cat /proc/758679/exe > /tmp/netservlet
# Output: No such file or directory

This indicates the binary was likely unlinked from the filesystem, pretty much as expected.

Investigation

Since direct access to the executable was blocked, I generated a core dump:

$ gcore -o /tmp/netservlet_core 758679

I could now simply use strings to further have a look:

$ strings /tmp/netservlet.elf | egrep -i 'stratum|pool|wallet|http|crypto|mining|eth|btc|pool'

Highlights included:

References to cryptocurrency mining: cryptonight, ethash_calculate_dag_item, mining.submit, mining.authorize.
Mining pool addresses: auto.c3pool.org:19999.
Miner configuration options: --cpu-memory-pool, --opencl, --cuda, --rig-id, http-access-token.

This confirmed that netservlet was a stealth crypto miner, likely XMRig or a variant. I thought we were over crypto bros and all over to AI-bros, I was mistaken 😂.

Just for fun, I also ran binwalk against the dump, which ended up with a 1.3GB gzip archive. We couldn’t just unzip it, though, due to obfuscation.

I will analyze it via ghidra later, today I should be OOO lol.

Conclusion

Remember:

Never trust random Docker images—your containers aren’t magic elves.
Keep an eye on system resources—they have feelings too.
Audit your host and containers often—because surprises are only fun at parties.

Alessandro Pogliaghi's Blog

Forking MeTube ~ You can just do stuff

The Itch #

POT (Proof-of-Origin) Support #

Jellyfin Integration #

Keeping Up with Upstream #

Use it yourself #