It works on Android, but I don’t believe it works on iOS.

For that they use iframes, which have a different security system.

Because of the CORS settings on Google’s servers would tell your browser to not go forward with the request. There are two ways it could eventually be possible:

• By opening the video in a new page/tab that only contains the video, with the YouTube player, which defeats the purpose a bit.
• By installing an addon or an app on your device.

Fair enough, that’s interesting. I assume this only applies to the non-web clients. On the web, it would not be possible. You can verify by looking at the outgoing network requests on this random video for example: https://invidious.privacyredirect.com/watch?v=qKMcKQCQxxI

I’m pretty confident that you are wrong.

Invidious and YouTube piped (and LibreTube) by default load the videos server-side, as opposed to GrayJay, NewPipe or Smarttube.

It has advantages (mostly that your IP address is not shared with YouTube, and it allows users from countries where YouTube is blocked to still access it) and inconvenients (much harder to keep up when YouTube actively seeks to block them).

LibreTube is also a good one. Basically an app for piped

https://community.brave.com/t/psa-current-faq/464018/30

Browsers based on chromium do not have to follow exactly what the main branch is doing. If they want to keep supporting MV2 or support different rules for MV3, they can. Albeit it’s a bit cumbersome.

Unfortunately, I think that while ad blockers won’t work as well, they will still work good enough that most won’t bother making the switch.

https://blog.getadblock.com/how-adblock-is-getting-ready-for-manifest-v3-6cf21a7884f6

https://github.com/uBlockOrigin/uBOL-home/wiki/

https://adguard.com/en/blog/adguard-mv3.html

https://www.reddit.com/r/uBlockOrigin/comments/1067als/comment/j3h00xj/

The main issue I see is the slow update of filters (which require an extension update). This might make YouTube win the cat and mouse game. Where YouTube updates(ed?) their blocking detection multiple time a day.

It would be crazy expensive to run an attack of this size for years.

There is no way a DDoS on the website in affecting the crawler. Also, running a DDoS attack of this size costs a lot of money (if you rent the network, if you own it it costs money as lost sales). No one is giving AI control over a DDoS network to just fuck around.

There is no domain name associated with the IPs.

Most importantly, usually, DDoS attacks use infected devices (PCs, mobile phones, smart fridges, shady browser addons etc…) to get many ip addresses and devices/locations and attack from everywhere at once.