Hacker News Reader

Comment by pawadu | Hacker News Reader

Holy crap, that code doesn't look good. I predict we will see more exploits for this project.

Maybe we should stop random people from contributing to complex C projects?

Wouldn't go that far from reading a single commit, but to anyone looking to pick up tips from a well-known respected C codebase: don't ever write

    (*(psz_text + 1 ) ) == '~'

when you can instead write

    psz_text[1] == '~'

Fewer tokens means less overhead for the human reader, and that asterisk-and-add pattern is exactly what the bracket array indexing operator does, so why not use it? This is one of my many C pet peeves, heh.

Also on a more personal note, if you're going to be putting things inside parentheses with whitespace, make it symmetrical.

"random people"? You mean there's some select group we know of that doesn't ever write bugs? (DJB doesn't make a group)

The main VLC developer is an amazing programmer. But if he uses his time to shave cycles off some SIMD decoding algorithm then boring things like file processing is done by random jr. developer.

The problem is that boring stuff can also be very security sensitive.

You are more than welcome to contribute and since you have a very strong opinion it seems you know your stuff, so go for it, nobody is charging a dime to work there in any case.

> you have a very strong opinion it

Yes I do, this is internet after all!

> seems you know your stuff,

Now you lost me :)

That was my hope when C was just gaining market share outside UNIX, and here we stand now.

Look at FFmpeg and all the multimedia libraries and you will be horrified.

I thought they cleaned up after the last round of exploits?

hahah :)

I wish :)

vlc has a bug and yet you talk shit about well developed and fuzzed by google projects. thats why vlc will never be better than mpv.

FFmpeg, VLC, MPlayer, libdvd*, libxvid, x264, libflac, libvorbis and all the other have multimedia library codebases started in the late 90s/early 2000. Noone cared much about security at that times.

All those projects are under-funded, done by volunteers, on countless platforms, doing very low-level stuff, and supporting many formats.

This has nothing to do with one project or another.

thats sad to hear, I didn't know volunteers did so much

Reply on news.ycombinator.com