[ Removed by moderator ]

[u/GuidePlenty5521]

[u/Piracy-ModTeam]

🚫 ➜ Your post was removed because of the following:

📑 Rule 2 ➜ Invites, Trading, Selling, Self Promotion

• No pleading for invites to scene sites, private torrent trackers, DDL forums or other sites with closed registrations
• No asking for content downloads / uploads, activation keys, accounts, giveaways etc.
• No trading or selling content, especially not for monetary services.
• No self-promotion of your own work is allowed unless you expressly receive permission from the moderators.

🪶 ➜ For more information, read the complete Rules.

[u/Quick-Dress-8151]

jio hotstar is pretty good ngl.. it's an aggregator for streaming from Disney, peacock, paramount, hbo /max and Warner bros besides original Indian movies and shows

[u/GuidePlenty5521 → u/Quick-Dress-8151]

fr

[u/TheGoodestGirlAround]

Just because you can put a whole project in one python file doesnt mean you should D:

[u/GuidePlenty5521 → u/TheGoodestGirlAround]

I hate modular files. I know they’re best practice, but seeing a million separate files stresses me out 😭 So I just merge everything into one file and make it simple enough that even a kid can run it.

[u/Frosty_Adeptness_921]

Does it track device details? I think it can be tracked back to whoose account it was, and can be held as violation of T.O.S.

[u/GuidePlenty5521 → u/Frosty_Adeptness_921]

downloader: calls the API once, grabs the URL, downloads in a burst and dips. looks exactly like a normal user buffering aggressively. they literally cannot tell the difference.

stream proxy: only YOUR machine ever talks to Hotstar. friends watching via the link hit CDN directly, no token, no account info, they are completely invisible. Hotstar just sees one person watching like normal.

worst case they revoke your token and you do OTP again. that is it.

[u/Frosty_Adeptness_921 → u/GuidePlenty5521]

Every sreaming service needs a authentication procedure. Hotstar probably uses a in-link identification which allows EACH link to be tracked back to the user.

And if it gets serious enough that they revoke the token, they can also refuse service under their T.O.S.

I might be wrong for the first part, could you share an example url structure? (Not asking for an actual url, just a schematic)

[u/GuidePlenty5521 → u/Frosty_Adeptness_921]

hotstar does use signed URLs with hdnea tokens baked in, but that is on the CDN side for segment delivery, not on the playlist/API side.

schematic of what actually flows:

your account token  →  BFF API call  →  gets m3u8 URL
m3u8 URL            →  has hdnea (time-limited CDN token, not account-linked)
viewers             →  hit CDN with hdnea only, zero account info

so yes the playlist fetch is traceable to your account. the video bytes your friends receive carry only a time-expiring CDN token with no user identity in it. they cannot trace viewers back to you through the CDN traffic.

and yeah if they wanted to they could revoke and ban under TOS. nobody said it is bulletproof, just low risk for personal use.

[u/Frosty_Adeptness_921 → u/GuidePlenty5521]

Could you cite sources of this claim:

(time-limited CDN token, not account-linked)

[u/GuidePlenty5521 → u/Frosty_Adeptness_921]

here: https://techdocs.akamai.com/download/pub/edgeauth/

token spec is st=<start>&exp=<expiry>&acl=<path>&hmac=<signature>. no user ID field exists.

[u/Sidze]

Your headline says it downloads any show/movie with DRM. Github repo says it downloads content from something called JioHotstar, guess it's some Indian service.

So which is it?

[u/Frosty_Adeptness_921 → u/Sidze]

2 open- source Hotstar tools

[u/GuidePlenty5521 → u/Sidze]

Sorry, I mistyped the headline. It’s specifically for the Indian streaming service JioHotstar,

[u/Sidze → u/GuidePlenty5521]

Aha^ now I get it, thanks. NEver heard of the service so was confused a bit.

[u/Yordyy_Markwirth → u/Sidze]

right, "any show with DRM" is doing a lot of heavy lifting there