5 ms·

Holy crap, that code doesn't look good. I predict we will see more exploits for this project. Maybe we should stop random people from contributing to complex C

by pawadu 9y ago

Holy crap, that code doesn't look good. I predict we will see more exploits for this project. Maybe we should stop random people from contributing to complex C projects?

pjmlp 9y ago
That was my hope when C was just gaining market share outside UNIX, and here we stand now.
viraptor 9y ago
"random people"? You mean there's some select group we know of that doesn't ever write bugs? (DJB doesn't make a group)
- pawadu 9y ago
  The main VLC developer is an amazing programmer. But if he uses his time to shave cycles off some SIMD decoding algorithm then boring things like file processing is done by random jr. developer. The problem is that boring stuff can also be very security sensitive.
  - aclsid 9y ago
    You are more than welcome to contribute and since you have a very strong opinion it seems you know your stuff, so go for it, nobody is charging a dime to work there in any case.
    - pawadu 9y ago
      > you have a very strong opinion it Yes I do, this is internet after all! > seems you know your stuff, Now you lost me :)
jbk 9y ago
Look at FFmpeg and all the multimedia libraries and you will be horrified.
- pawadu 9y ago
  I thought they cleaned up after the last round of exploits?
  - jbk 9y ago
    hahah :) I wish :)
- eth_hero_12 9y ago
  vlc has a bug and yet you talk shit about well developed and fuzzed by google projects. thats why vlc will never be better than mpv.
  - jbk 9y ago
    FFmpeg, VLC, MPlayer, libdvd*, libxvid, x264, libflac, libvorbis and all the other have multimedia library codebases started in the late 90s/early 2000. Noone cared much about security at that times. All those projects are under-funded, done by volunteers, on countless platforms, doing very low-level stuff, and supporting many formats. This has nothing to do with one project or another.
    - eth_hero_12 9y ago
      thats sad to hear, I didn't know volunteers did so much
unwind 9y ago
Wouldn't go that far from reading a single commit, but to anyone looking to pick up tips from a well-known respected C codebase: don't ever write (*(psz_text + 1 ) ) == '~' when you can instead write psz_text[1] == '~' Fewer tokens means less overhead for the human reader, and that asterisk-and-add pattern is exactly what the bracket array indexing operator does, so why not use it? This is one of my many C pet peeves, heh. Also on a more personal note, if you're going to be putting things inside parentheses with whitespace, make it symmetrical.

by pawadu 9y ago

Holy crap, that code doesn't look good. I predict we will see more exploits for this project. Maybe we should stop random people from contributing to complex C projects?

pjmlp 9y ago

That was my hope when C was just gaining market share outside UNIX, and here we stand now.

viraptor 9y ago

"random people"? You mean there's some select group we know of that doesn't ever write bugs? (DJB doesn't make a group)

pawadu 9y ago
The main VLC developer is an amazing programmer. But if he uses his time to shave cycles off some SIMD decoding algorithm then boring things like file processing is done by random jr. developer. The problem is that boring stuff can also be very security sensitive.
- aclsid 9y ago
  You are more than welcome to contribute and since you have a very strong opinion it seems you know your stuff, so go for it, nobody is charging a dime to work there in any case.
  - pawadu 9y ago
    > you have a very strong opinion it Yes I do, this is internet after all! > seems you know your stuff, Now you lost me :)

jbk 9y ago

Look at FFmpeg and all the multimedia libraries and you will be horrified.

pawadu 9y ago
I thought they cleaned up after the last round of exploits?
- jbk 9y ago
  hahah :) I wish :)
eth_hero_12 9y ago
vlc has a bug and yet you talk shit about well developed and fuzzed by google projects. thats why vlc will never be better than mpv.
- jbk 9y ago
  FFmpeg, VLC, MPlayer, libdvd*, libxvid, x264, libflac, libvorbis and all the other have multimedia library codebases started in the late 90s/early 2000. Noone cared much about security at that times. All those projects are under-funded, done by volunteers, on countless platforms, doing very low-level stuff, and supporting many formats. This has nothing to do with one project or another.
  - eth_hero_12 9y ago
    thats sad to hear, I didn't know volunteers did so much

unwind 9y ago

Wouldn't go that far from reading a single commit, but to anyone looking to pick up tips from a well-known respected C codebase: don't ever write (*(psz_text + 1 ) ) == '~' when you can instead write psz_text[1] == '~' Fewer tokens means less overhead for the human reader, and that asterisk-and-add pattern is exactly what the bracket array indexing operator does, so why not use it? This is one of my many C pet peeves, heh. Also on a more personal note, if you're going to be putting things inside parentheses with whitespace, make it symmetrical.