Postby tch_ » 22 Dec 2010 14:17
I see. Not too nice of the trolls, but do not except anything else from trolls.
As for the patch: All of win and Mac users, and most of Linux users are using the precompiled binaries. As a Linux user i examine the question from the aspect of a default Linux user with a popular distro (Suse, Ubuntu, Fedora...).
A default Linux user with basic skills, selected his distro by the easyness of it's usage. In these popular distros, the user just get the package from the repo and installs it by "nextnextnext" just as on windows or OSX. And these repos ALWAYS contains a default built VLC, with anyithing VLC team implemented in it. So, whatever patch has been posted to you - unless if you did not put into the main version - anyone who uses the repos will be forced to recompile the binaries. (Or hack them, as i did.)
So whoever, who want to get rid the santa icons, or want to use it as root, already stucked in the beginning, since he has no knowledge in compiling manually. And there goes the patching. If someone cannot even compile the software (wich is not too hard, mostly it is ./configure, make, make install), then how do you except him to patch the code of a complex software?
Okay, expreienced users can make forks, and can put their precompiled binaries on the net, so this is one solution. But, how you can be sure, that these binaries are okay? What if their creator put something nasty into it? These alternative forks cannot be trusted, even if source is included, since if even the repo maintainers find code analyzing hard, and choose the easy method instead and fill the repo with binaries built from the default sources (not just VLC, any project), then what do you except from a basic user? Your default VLC source stream is the trusted version of VLC and everyone accepts and use it. So source patches are not a solution, unless you put into the main stream, as i said. Anyway source alternating is the way of the programmer, not the basic user.
So, still there is binary alternating. I disassembled the default "vlc" binary and the "qt4lib_plugin" library and instead of recompiling them, i made programs wich neutralize the relevant code sections, to escape the source recompiling. And i made it public, so anyone can directly patch VLC if wanted. But however, as you see above, the first thing were asked from me was the source, to check it is really a patch and not a virus. A bright example, that anything external stuff wich alternates VLC is not trusted by VLC users. And i cannot blame them, i would not trust unknown sources either.
So the only real userfriendly and trustable solution is removing the relevant codes from the mainstream. It's your decision, but i think you would not suffer any deficit from removing the root protection or the santa icons.
Anyway i still cannot comprehend why do you let the user use VLC as admin under win and why limit him under Linux, since windows has much more security problems. Just wondering.