/usr/share/vlc/http/.hosts get overwritten on every single reinstall and upgrade unless your package manager supports some kind of CONFIG_PROTECT variable (gentoo have this). This is important because some (all?) remote control software utilize the HTTP interface, which means you have to redo changes to this file every time you update VLC.$XDG_CONFIG_HOME defines the base directory relative to which user specific configuration files should be stored. If $XDG_CONFIG_HOME is either not set or empty, a default equal to $HOME/.config should be used.
I hope I get corrected on this, but as it stands now it seems XDG compliance is only partial and the change log should be updated to reflect this, alternatively VLC should be changed to obey the full XDG spec.
For reference:
vlc --version
VLC media player 1.0.3-rc Goldeneye
VLC version 1.0.3-rc Goldeneye
Compiled by root@stargate.
Compiler: gcc version 4.4.2 (Gentoo 4.4.2 p1.0)
Thank you!