>_exactly_ like malware

But it's googlevideo.com. I know this is Google/YouTube's domain so the rest doesn't matter.

Which is besides the point and a minor nitpick at best.

The fact of the matter is these techniques are well established black hat ways of preventing the user from discovering what you're doing on their device.

Discovering what exactly? To bad they don't use a subdomain called "adplayback" I guess, but the query parameters are obviously only useful for YouTube internal, not the users.

And I won't even call them "obfuscated" -- it's just a batch of switches and plain IP and ID hash.

But it's googlevideo.com, how could it be a video of some shyster pimping get-rich-quick investment schemes that are convincing enough to appear totally legit to anyone below the half-way point of the bell curve?

But it's a google ad, how could it link to a scam that looks exactly like my bank's website?

We're talking about why this URL does not look like malware. The content of the video itself is irrelevant.

Back when YouTube wasn't owned by Google, replacing /watch?v=... with /get_video?video_id=... in the URL would immediately give you the video file (in FLV format, of course.)

There was also a relatively brief time when YT was owned by google but ads were delivered from a separate (sub)domain so DNS adblocking would work wonders.

Those days are gone as the distinction between ads and malware becomes a technicality.

In HN I expect a better analysis than "this looks complicated so it must be bad". That's the kind of logic that someone who knows nothing about computers has.

Yes, I evidently compared the obfuscation techniques to malicious actors because I know nothing about computers!