VLC has some problems..

[Rémi Denis-Courmont]

I don't wish to appear to be sarcastic, but I think most users know how to post a link to a log file they've created on Pastebin so your above mentioned comment is hardly valid in that respect.

First, a log is more often than not insufficient. We typically need a sample and/or a symbolic stack trace. And I don't even agree. How to get the full log out of VLC is not exactly obvious.

Setting up 2FA on the other hand is unnecessarily complicated even with the help of the official documentation.

You're just as welcome Lotesdelere to provide simpler documentation.

Also, 2FA can be bypassed which may put the user's phone number at risk.

Would you care to explain exactly how the 2FA from code.videolan.org can be used to expose the user's phone number?

Relying on third party authorization services is usually going to mean using one of the major services like Google or Microsoft or similar in order to be certain the third party service itself hasn't been compromised.

Third party services are provided as an alternative because some people requested it. Nobody was ever forced to use any of them.

I understand that you as a developer use TOTP constantly and in that respect 2FA is essential, but the number of times ordinary users are going to post a bug on Videolan/Github can probably be counted on the fingers of one hand.

Three hundred millions of Europeans have to (learn to) use 2FA for their online payments as of PSD2, just saying. Not to mention, what, a billion Facebook users. Gee, even my airline loyalty program has TOTP 2FA nowadays. There are obviously plenty of computer-illiterate people who can't use 2FA, no doubts. But it's much easier and more common than writing an usable VLC bug report, so that's hardly a limiting factor here.

As for the people who simply cannot be bothered to set up a the VideoLAN-specific 2FA instance, I can understand that. But they were not going to bother following up on their bug report either, if they even bothered to follow the bug reporting guidelines (probably not). I maintain that most lost bug reports would have been inexploitable.

But for the umpteenth time, if you want better documentation and a sticky post, you are most welcome to write it. VideoLAN cannot remove the 2FA requirement, so there is no point whining about that. I won't be answering to this thread any longer as there is clearly no point.