July 22, 2010

VLC 1.1.1 is out: GPU decoding for ATI

Posted in VideoLAN tagged , , at 09:20 by Géal

VLC 1.1.1 was just released! A lot of bugs were fixed, and now, GPU decoding works on ATI cards! You need Catalyst 10.7 to use DxVA on your ATI GPU.

Other important news: libVLC has a lot of new useful functions, like libvlc_set_user_agent(), or libvlc_video_set_callbacks() and libvlc_video_set_format() to replace the –vmem-* hack.

Enjoy this new release!

July 7, 2010

I hate the web

Posted in General tagged , , , at 14:38 by Géal

I first experienced Internet at the glorious time of the 56k. It was slow, hard to browse, and full of badly designed websites. But it was fun to discover. At that time, people were still trying to figure out the answer to “what the hell can I do here?”, were experimenting a lot, and shared their results.

Then the internet bubble grew and… I won’t waste time telling that story, that’s not my goal here. Let’s go forward a little, to that new trend, the Web 2,0.

It was the beginning of social media, users producing content, companies investing a lot to reach those users. And somewhere, something went wrong. It was quiet at first. People were wondering how to get a better rank in search engines, how to blog, how to create a buzz. Some of them were really trying create value, and share it with the right users. But others didn’t think like that. They found a way to make money out of thin air.

How to be successful on the Interwebz

Take a lot of incompetent people, more or less linked by a common interest-let’s say “being famous”, as an example- and able to communicate with each other thanks to social networks. One of them will see a post somewhere describing someone famous, and will share it with the rest. He will share other articles for a few months, and all the incompetent fools will be pleased  to learn about how famous people became famous.

Then, he will begin to write articles that rephrase the ones he sent a few months ago. All the incompetent fools will thank him for sharing his insight in being famous. And if he doesn’t find anything to write, he will rephrase one of his own articles, with a catchy title like “top ten ways to create a viral video” and a lot of bullet points. And some of the incompetent fools will share these articles (mostly because they’re not smart enough to go and find the original content by themselves).

Little by little, he will be recognized as an expert in being famous, and will start a consultant job, and will be overpaid to teach the incompetent fools how to be famous. And then, those incompetent fools will start to share themselves, and blog, and become consultants and make money. Don’t you recognize something?

The Ponzi scheme web 2.0 expert

That’s the Internet we see now, and I find it disgusting. No real content, people quoting each other, and experts telling us “Get rich following my method, it worked for me, why wouldn’t it work for you?”. Social networks gave the crooks an easy way to legitimacy. Why would you bother working hard, when you can quickly get exposure by preaching to the incompetent crowd?

If you follow most of the news, you will think that those people talking about SEO, copywriting, web marketing or community management are the ones building the web. They’re not. Internet is there thanks to a lot of quiet system administrators, developers and electronics engineers. They’re not necessarily following new trends. They’re at their origin.

If you want real content and real value, look for these people. If you want to build something useful, learn from them but follow your own path. Inventing is not about repeating what smart people say, but contradicting them.

July 2, 2010

Current state of security in VLC on Windows

Posted in Security, VideoLAN tagged , , at 13:34 by Géal

A recent report from Secunia states that popular Windows applications don’t use the DEP and ASLR protections. It is true for VLC up to 1.0: the latest version at the moment, 1.1, supports permanent DEP mode, and ASLR on all of its DLLs.

One thing the report could have shown is the difference between applicatins built with MSVC or GCC. Adding DEP and ASLR in Visual Studio means adding /NXCompat and DynamicBase to the compilation options. With MinGW, there is a different trick. This article on my old blog is slightly outdated: ld in binutils 2.20 supports the –nxcompat and –dynamicbase options. So, now, the developers using GCC have no more excuse!

Let’s sum up the state of the security of VLC:

  • 1.0.5 is NOT SAFE on Windows. 1.0.6 brings a lot of security fixes, but this version was not released on Windows. And security features are not used.
  • 1.1.0 supports permanent DEP and ASLR (with DllCharacteristics flag, only on Vista/7) and termination on heap corruption
  • 1.1.1 supports the same as 1.1.0, and adds DEP on XP SP3 with SetProcessDEPPolicy
  • SafeSEH and stack cookies are not yet used

The developers using LibVLC should check their software: DEP won’t be activated if their executable doesn’t support it.

June 13, 2010

Web vulnerabilities in an HTML 5 application

Posted in Security, Web tagged , , , at 13:39 by Géal

For the past few days, I have been messing with some of the features of HTML 5:

  • local storage
  • Offline web applications

These features enable the development of real applications, running in the browser. It has a lot of advantages: easily updating the application, reduce the workload on the server, etc.

But it changes the way you write your code. You have to adapt the usual protection mechanisms to these changes.

Here are some thoughts about the common web application vulnerabilities.

Warning: I consider here a web application with practically no server-side code: everything executes in the browser. And I’ll use the point of view of someone attacking the application running in the browser. And I’ll be optimist enough to trust the browser…

SQL injections

SQL injections in servers let you access the user’s data, and access the server itself (file uploads, starting external programs, etc). With local storage and WebSQL, you won’t be able to access the host, only the data (unless there’s a browser vulnerability about that). And you can use some sort of prepared statement syntax to prevent injection. There may be a risk with key/value stores if you let the user input control the key.

Cross site scripting

This is in my opinion the biggest risk. If all the logic of your application is on the client’s side, unwanted code executing in the browser has access to everything. This one can be mitigated by filtering what will be displayed on your webpage.

Cross site request forgery

This one is not critical, unless you use locally URL parameters (don’t laugh, it has often been done and exploited in Flash applications). Be aware that an attackant could get data in local storage that way.

Persistency

It really worries me that so much data can stay a long time in the user’s browser. With a database hosted on your server, if unwanted data(persistent XSS, malwares…) is stored, you can erase it, patch your website’s code, and your users will be safe.

With HTML 5, you’ll have to clean every user’s data. You can’t be sure that you have  protected all your users (someone could wait 6 months before coming back to your website). And because you can’t be sure, your code has to check for each known bad data. It needs a lot of code, time and tests.

Trust issues

It has been said a lot of times already: don’t trust the data coming from your client. And in our case, don’t trust it, even if it’s data that your website put in local storage. It applies to data that will come back to your server, but also to data that will be displayed with a bit of Javascript/DOM code. Yes, XSS attacks could come from local storage. So, you need to escape everything that wil go into the webpage.

Are we screwed?

These were only quick thoughts about the vulnerabilities you could encounter with client side web applications. It is not really hard to protect the application, but you have to be very careful about what data you will trust. The good thing is, these vulnerabilities are not new: you can see them in lots of Flash applications. So, the mitigation mechanisms are well known, and easy to apply.

May 17, 2010

I hate installers

Posted in Reinventing the wheel tagged , , at 22:41 by Géal

And I’m pretty sure a lot of people will agree with me. They’re an usability nightmare. They still look the same since Windows 95 (I think it’s even older than that, but thankfully, I’m too young to have known previous versions). The *click next* *click next* *click next* *click Finish* ugly grey thing is driving me crazy.

So, how can we improve user experience on installation? First, let’s recall the classic installation process.

The (ugly) state of the art

Someone tells you about this amazing new software that you just have to try. Or you just know you need it to get your work done. So, you google it a little (for the ones that are still stuck in the 20th century, you buy a pack of CDs in a shop), you quickly find the editor’s website. It’s a shiny website full of marketing tricks to persuade you that you want to download it. Or it’s Sourceforge. Whatever, you find a way to download it.

That was the easy part. You’re already bored and looking at pictures of kittens, because the download took a long time. But you really want to install the software, so you start the installer. And the nightmare begins.

  1. First, the UAC prompt (for those of us that use Vista/2008/7). It tells me that the installer needs admin rights, and that this piece of software has no verified publisher. Whatever, let’s just click ok.
  2. Before launching the real installer, the file I just downloaded uncompresses and starts another installer.
  3. First window, asking me which language I want to use. Click next.
  4. A window asking me to agree to a reaaaaaaaally long piece of US piece of shlegal text. Click next.
  5. A window asking me if I want a simple, advanced or custom installation. Click simple then next.
  6. A window asking me (it really asks a lot, can’t it figure it out without my help?) where I want to put my software.
  7. Now, if I’m lucky, the “next” button has been replaced by “install”. Or there’s yet another window to sum up my installation settings. Click install.
  8. Yay, it’s the revival of DOS for Windows users. I see a lot of file names scroll on the window, too fast for me to read their names (I don’t really care anyway).
  9. Is it done yet? No, now it asks me if I want to put the a shortcut in the quicklaunch bar, or on the desktop. Sometimes, it will even ask me if I want to launch this application on startup. Click next.
  10. If I’m really lucky, I go to the next step directly. If I’m not, it wants me to update my DirectX version, or to install the new wonderful browser bar that I really need (go back to step 3).
  11. \o/ the last screen. Asking me to choose yet another thing: do I want to read the README.txt file? Do I want to go to your website? Do I want to launch the program right away?
  12. Well, in fact, I didn’t go up to this step. I died of boredom long ago.

And this is what I have seen for the past 15 years (well, I didn’t include all the weird installation errors that I have seen). So much for innovating and improving the life of the users. The first interaction people have with software done by your company is the installer. For me, that means a lot. If they’re too lazy to get this right, I’m probably to lazy to try their software.

Now, let’s go back to the interesting question: how can we improve the user experience of installers?

The (easy) critics

I would like to say “install a Linux, use a package manager and let’s roll” (yes, I KNOW you thought of it), but since the CoApp project isn’t ready yet, we will have to find another way to please Windows users.

Let’s go point by point:

  1. About the UAC, I can’t force you to buy a code signing certificate. But if you can afford it (between $90 and $300 a year), it can make your software look a lot more professionnal. And you can use your WinQual account, which is really nice.
  2. Why would you uncompress a lot of files right now? Is your installer a Java ERP? No? Then, only uncompress the files when I ask you to install them.
  3. For this one, I have mixed feelings. The default setting shouldn’t be English, but the detected language of the OS (come on, it’s not that hard to do). One thing you have to get right: if you ask for a language, it’s not only the language used in the installer, but it will be the language used in the installed software. I shouldn’t have to choose the language two times.
  4. For the EULA, I don’t really know what I can do, as I am not a lawyer. But I’m not really sure that a legal agreement written in english and referring to US law complies to my country’s laws.
  5. This one is obvious. How many of your users will need the advanced settings? yes, the whining 0,1%. The other 99,9% will just use simple anyway, so why would you ask them to choose? And what options could be so important that you need to treat them as advanced?
  6. OK, this one is easy. Most people will not even choose another installation folder. One thing that I would really love (but there, it’s a matter of taste): don’t use a path like c:\Program Files\MyCompany\MySoftware, but c:\Program Files\MySoftware. People install a software, not an advertisement for your company. And not finding your installation folder later because you’ve hidden it deep under a meaningless folder name is definitely not nice.
  7. Oh, my installation settings. Think about it. If I’m a dumb user just wanting to install quickly, I don’t care about these. And if I care about my installation settings, I know exactly what I chose. So this one is useless.
  8. OK, the scrolling list of files. I know it’s useful if you’re debugging your installer. It’s useless for me. Just put a pretty progress bar. If you really want to display things, instead of writing “uncompressing pouet1.png, copying pouet1.png, uncompressing pouet2.png, copying pouet2.png”, write “installing shiny new themes”.
  9. I have mixed feelings about this one. I would say: let the user choose for the desktop shortcut, don’t ask for a quicklaunch icon (the user will know how to drag and drop the desktop shortcut on the bar), and definitely don’t ask to launch at startup. Be a responsible developer, don’t waste CPU cycles, and save the planet.
  10. For DirectX, do whatever you want. I would prefer that you warn me about the update before I get to step 8. For the adware bar, just stop it. If you want to make money with your software, just sell it. But if you really don’t care about user experience, go ahead and install spyware on your user’s computers. I’m sure they will love that.
  11. Do you really think people will read some quickly written presentation of your software in Notepad? No. Do I want to go to your website? Seriously, that’s where I downloaded the installer. While I’m at it, I’m trying to find some documentation on your website, but there’s nothing useful there. Do I want to launch your application? This one makes me laugh. What will happen if I click yes? In 90% of the installers, it will launch the application. With Administrator’s rights. Seriously, isn’t that obvious? So, two possible fixes: learn to drop the rights of a Windows app, or don’t even launch the application at install time.

The (really easy) fix

Well, that doesn’t look so hard to do, right?  I’ll sum up my ideal installer’s behaviour:

  1. Sign your installer with a code signing certificate recognized by Windows (you can leave that part if you have no money).
  2. Start immediatly with a good looking screen, showing the logo or a good picture of your software, and in small in a corner, the logo of your company. And a well written presentation of your application. If the installer will install other applications, warn the user there. You should have detected the language of the user befor launching. Provide a droplist to change the language on this screen, but put it out of the way (like, in the bottom left of the window).
  3. Next, the EULA. If you find a way to get rid of it (maybe put the agreement on the website, wher it’s easier to read), or to simplify it, do it.
  4. Put all the installation options on the next screen. Only show the ones the user really needs to look at. Add an “advanced settings” button, and again, put it out of the way. You have the permission to use a good looking effect to switch from simple to advanced view and vice versa. By installation options, I mean the install folder, the desktop shortcut, the eventual plugins, etc. Don’t forget to show the disk space needed for installation. The next button should now be an install button.
  5. Use a good looking progress bar, and meaningful log messages. Maybe provide an error logfile somewhere if something went wrong. You can show some good marketing messages and pictures there. I don’t guarantee that people will look at them, but if they’re waiting, try to prevent the boredom from showing up.
  6. The last screen, yes! If you really don’t want to listen to my advice, at least remember to drop the admin rights before launching the application. Instead of asking if the user wants to see the README, provide links to the documentation (on the disk, or on your website), tutorials, screencasts.

And now, that’s an installer I would like to see: 5 screens, 5 clicks in the best case, no useless clicks in the worst case. Quick and easy. Don’t hesitate to add some eye candy. Anything can look better than those grey installers we’re used to.

Oh, and a last thing, which will content a totally different sort of users: please, please, provide a silent installation, with all the options accessible from command line. the system administrators will love you.

January 20, 2010

5 reasons to wait for VLC 1.1

Posted in VideoLAN tagged , , , at 11:30 by Géal

The next VLC media player release is drawing near (it will be ready when it will be ready), and it comes with a lot of new features and bugfixing:

GPU decoding

One of the coolest new features (do I say that because I worked on it?). We can now decode videos using a graphic card, with DxVA on Windows Vista and 7, and VAAPI on Linux. If you want to test, we are looking for a little help.

Media library

That is a feature a lot of you are waiting for. We will now store a list of all your files in a database using Sqlite.

Windows 7 integration

Some of you already know that VLC media player 1.0.3 is compatible with Windows 7. We didn’t stop there. The next release will bring you cool taskbar buttons à la WMP, jump lists, thumbnails, etc.

Interface rework

I like the grey VLC. Maybe I have forgotten what the word “ergonomic” means. But some of the developers have not, and they’re doing an amazing work with the Qt interface, to change the layout, add nice effects and make it a lot prettier.

Lua extensions

People who read my previous blog know that I love tweaking VLC with Lua scripts. One developer had a nice project for this year’s Google Summer of Code: adding a way for lua scripts to change the interface. Now, lua scripts can add menus, open windows, etc. OK, it doesn’t sound cool at first, but what you will see thanks to this code is really nice: automatically downloading lyrics and subtitles, finding data on IMDb, doing a Google search, whatever you want! Isn’t that cool?

Still not convinced?

These were the features I’m excited to see in the next release. But that’s not all:

  • N900 port
  • Milkdrop visualizations using projectM
  • WPL and ZPL playlist support
  • desktop mode for Direct 3D video output (you know, the trick to show the video as a wallpaper…)
  • …

January 11, 2010

People based motivator

Posted in General tagged , , , , at 16:07 by Géal

For this new year, I have no resolutions. Well, I have the usual “do a little workout”, “don’t get up so late”, but I don’t really have faith in these. Instead, I have a list of projects on which I’m working or I’m wanting to work. And I often have difficulties motivating myself.

My solution is: if you’re interested in any of these ideas, come and poke me regularly, to remind me that I have to finish that project :)

Here are the projects:

  • Package manager for Windows: my final year project at Centrale Lille (in progress)
  • Wix port on Linux: because some projects want to generate their installers on Linux, because some people don’t want to use Mono, and because I like to play (started)
  • Open source sandboxing application for Windows (in progress)
  • MTP synchronization in VLC media player (in progress)
  • Crash report handling web interface for VLC media player (in progress)
  • Qt embedded interface for VLC (not started)
  • Complete the Windows 7 headers I’ve written for VLC and send then to MinGW (not started)
  • Contribute to VLMC (not started)
  • Add Minidump support in GDB: I need it (not started)
  • Generate .lib import libraries with ld or with some custom binary running on Linux (not started)
  • Scriptable web client in Python supporting Javascript with V8 bindings (not started)

Some of these projects are maybe too ambitious but, you know, if you aim high, you fail higher than those who succeed :)

If you’re interested in some of these projects and would like to discuss them with me, feel free to contact me!

January 5, 2010

New blog, new year, new whatever

Posted in General at 19:53 by Géal

Hello, happy readers and indexing bots! Here is my brand new blog!

The old one was getting messy, alterning french and english posts without any reason, and it had no purpose.

So, I present you with my new blog: a place for me to write about fun code, weird bugs, even weirder opinions, and to share a lot of bad puns.

I host it on WordPress.com, so that its admins do all the boring work in my place. Thanks, guys!

I will copy my tutorials for VLC media player from my old blog to the VideoLAN wiki, and the other posts still useful (if there are ones) will be posted here (dear WordPress.com admins, could you add the Dotclear importing plugin here, please?).

That’s it, have a good time reading this blog, and happy new year!