jbk

22 ms·

271.
by jbk 7y ago
This is, unfortunately, the answer. Whenever we post something, unless it is on Twitter, noone reads it.
272.
by jbk 7y ago
a journalist is on Windows or mac. They could even chekc that it does not crash with the provided sample.
273.
by jbk 7y ago
VLC is open source, distributed by VideoLAN non-profit and is totally non-commercial. The only money received by the non-profit is through donations.
274.
by jbk 7y ago
Because everyone uses CVE. And then, it gets in the press...
275.
by jbk 7y ago
Absolutely not: - the reporter never contacted us, we have a clear process and a bounty program. We checked again, he never did. - we receive and process all security issues privately: we fixed 31 of them in the last update. And miracly, th
276.
by jbk 7y ago
An issue on one or two Linux distribution for a OOB-read crash is very very different from "VLC vulnerable on all machines, uninstall now!" Especially, since the very very large majority of VLC users are not on Linux, but using bi
277.
by jbk 7y ago
Because we support playlists. I know it does make sense, but Mitre is never answering.
278.
by jbk 7y ago
> I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. They always do that with VLC: even file can be on a playlist, and a playlist can be sent by email or ove
279.
by jbk 7y ago
But the biggest issue is that they refuse that we become the CNA for VLC bugs. So, they are the root CNA for VLC bugs, and they don't triage them correctly. And don't update the issues when we mention them.
280.
by jbk 7y ago
> To boot https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it Of course, we never reported such a thing: a security issue in a 3rd party library, fixed more than 16
281.
by jbk 7y ago
> So none of the tech news websites contacted VideoLAN and published their articles without checking their source. Actually, one did: numerama. That's all. > I feel bad for VideoLAN, according to them the bug was in a 3rd party
282.
by jbk 7y ago
The issue is more a rogue mirror, than the main website being hacked. But yes, this is very true.
283.
by jbk 7y ago
Well tor project and VLC have a very different audience, but I'll see what I can do.
284.
by jbk 7y ago
All videolan files are GPG-signed and have several hashes (md5+sha1+sha256)
285.
by jbk 7y ago
> Removing phrases like "security-asshole" in the first place would also go a long way. I absolutely refuse to remove phrases like that. This is exactly what some of those people are and because they are security people does no
286.
by jbk 7y ago
> Did you really get any of these, or were you exaggerating? All of these, in this single 3-months bug bounty program. I'm absolutely not exaggerating. > If you really did and they're public anywhere (and the people weren&#
287.
by jbk 7y ago
> Will you at least acknowledge my criticisms of the Video Effects user interface problems, please? Have there ever been any bug reports on that that you can remember? I'll try to dig that one up too. Of course, the video filters UX
288.
by jbk 7y ago
> and he brushed it off and dismissed my bug report, telling me simply not to do that. I did not do that. That's totally not true. You are confusing me with someone else. And the bug is fixed. > after the author of VLC won't
289.
by jbk 7y ago
Excellent point: yes, we fixed (actually worked-around) that bug in this release. Sorry about forgetting about it: I cared more about the FOSSA project here, and forgot about this.
290.
by jbk 7y ago
(author of the blogpost here) > It's not clear whether the asshole in question is being dogmatic about some ninety-day disclosure-to-publication deadline or whether they're maybe being rude about the project having security bug
291.
by jbk 7y ago
(I'm the author of the blog) > Is this really valid? Yes/No. The issue is more about categorizing between low, medium, high and critical security issues, because this impact the bounties values. So, we have to define some guide
292.
Google kills its Twitch killer(arstechnica.com)
7 points by jbk 7y ago|3 comments
293.
by jbk 7y ago
Yes, the nightly build.
294.
by jbk 7y ago
This is fixed for VLC 4.0 then.
295.
by jbk 7y ago
You realize that you cannot filter all ads from AdSense, right? We already spend > 2 hours per day to clean them.
296.
by jbk 7y ago
I will look at that, thanks.
297.
by jbk 7y ago
> I thought VLC was better than scams like that. This is the ads from Google or some other ads providers. We don't control this. The VLC Torrent Streamer, though, should be just the VLC/bittorent plugin, no?
298.
by jbk 7y ago
> -For some reason sometimes it hangs in Fedora and I have to kill the process manually. Check your hardware acceleration drivers (vaapi, vdpau) and try to disable it in VLC preferences. > -I wish that the progress bar allow more cont
299.
by jbk 7y ago
Mp4 files? What format? What OS?
300.
by jbk 7y ago
Can you share the files where you see that? VLC 4.0 will get gapless audio and a different audio management, that will improve the quality.

More ›