jbk

33 ms·

1. 421.▲
   by jbk 9y ago

   60k would be enough in Paris, I would say :)
2. 422.▲
   by jbk 9y ago

   I pay my bills with the startup I created to sustain the VideoLAN community. We have a few other products that will come to life later. Invest in it!
3. 423.▲
   by jbk 9y ago

   Ahah. No. Les héros de l'Internet, c'est Aaron Swartz, Jimmy Wales et Sam Hocevar. Pas moi :)
4. 424.▲
   by jbk 9y ago

   Serious people offering money? A couple. Clean business models? none. Spyware and hacking is not a clean business model, as far as I am concerned. But, you know, you can invest in my startup, if you prefer :)
5. 425.▲
   by jbk 9y ago

   SSL is already there.
6. 426.▲
   by jbk 9y ago

   That's me. However, I am not the VLC creator, just the one working on it since 10+ years. And I created the non-profit organization. See the AMA for more details ;)
7. 427.▲
   by jbk 9y ago

   See also this article on NXi about it https://www.nextinpact.com/news/104552-auto-entrepreneurs-ob...
8. 428.▲
   by jbk 9y ago

   Knowing that today we still see bandwidth issues in VLC, even without IPC, I kind of doubt it.
9. 429.▲
   by jbk 9y ago

   Well, no. Because you can do it per-process. I don't see the reason of doing it per threads here.
10. 430.▲
    by jbk 9y ago

    Indeed, but that's not what GP is referring to.
11. 431.▲
    by jbk 9y ago

    VLC updates are signed with asymetric encryption. HTTP or HTTPS does not change that.
12. 432.▲
    by jbk 9y ago

    > It helps developers ignore bugs, since they can no longer reproduce them. Well, it would crash, so they can reproduce it, no?
13. 433.▲
    by jbk 9y ago

    2.2.6 is deployed.
14. 434.▲
    by jbk 9y ago

    > I understand that retrofitting an existing program to use a multi-process sandboxing model is far from easy, and I'm definitely not volunteering to do it, Yes, that's the core of the issue.
15. 435.▲
    by jbk 9y ago

    It is something that we chose to do. We usually let between 24hours and a few days before doing an upgrade, seeing the possible regressions. From tag to release to updates can take only 4hours, if we want enough mirrors.
16. 436.▲
    by jbk 9y ago

    FFmpeg, VLC, MPlayer, libdvd*, libxvid, x264, libflac, libvorbis and all the other have multimedia library codebases started in the late 90s/early 2000. Noone cared much about security at that times. All those projects are under-funded
17. 437.▲
    by jbk 9y ago

    Blurays are 60Mbps. Then with 40k60 + HDR, displaying is quite a lot of bandwidth.
18. 438.▲
    by jbk 9y ago

    Try 3.0, this is fixed.
19. 439.▲
    by jbk 9y ago

    That's also why we're perplexed at the supposedly code execution. Also, the security researcher did not provide a demo for the VLC exploit. Their demo is only on Kodi and popcorntime. But anyway, security issues means releases.
20. 440.▲
    by jbk 9y ago

    I think we can do everything now for the majors OSes, but I'd guess this is a 50-100 man-month work for VLC.
21. 441.▲
    by jbk 9y ago

    There are none. You can use VLC inside VLC sandbox, but you won't get something perfect.
22. 442.▲
    by jbk 9y ago

    Then people add full BASE64 fonts inside the subtitles. Fonts that have a virtual machine in...
23. 443.▲
    by jbk 9y ago

    > but since you were apparently unaware that there was an alternative I will refrain from answering to such attacks. As you seem to know better, I'm waiting for your patches.
24. 444.▲
    by jbk 9y ago

    But the issue is not only file access. File access is a small part of the main problem.
25. 445.▲
    by jbk 9y ago

    See comment above with "the solution". Either you need to have multi-process and correct IPC, or you need to copy.
26. 446.▲
    by jbk 9y ago

    But you need to pass data from the access to the stream_filter, from the stream_filter to the demuxer, from the demuxer to several decoders, from the decoders to potentially a few video-filters and chroma-converters, and then finally to the
27. 447.▲
    by jbk 9y ago

    But that's just ONE of the issues. The issue here is that the decoder/parser is in a process that has a too many privileges...
28. 448.▲
    by jbk 9y ago

    But you need to pass data from the access to the stream_filter, from the stream_filter to the demuxer, from the demuxer to several decoders, from the decoders to potentially a few video-filters and chroma-converters, and then finally to the
29. 449.▲
    by jbk 9y ago

    But SSA is not. It's specifying a font and sometimes even shipping a font inside the SSA file.
30. 450.▲
    by jbk 9y ago

    That's exactly the point above. See my above comment.