[vlc-devel] Signing the VLC ActiveX control

[Denver Gingerich]

I have been discussing the feasibility of using the VLC ActiveX
control for playing Theora in Internet Explorer on the Theora list
(see http://lists.xiph.org/pipermail/theora/2009-July/002554.html )
and several people have stated that the ActiveX control is just not
reliable enough for production use:

http://lists.xiph.org/pipermail/theora/2009-July/002555.html
http://lists.xiph.org/pipermail/theora/2009-July/002557.html

I suspect this a result of the signing problems that the VLC people
have had in the past (which has caused development of the control to
languish), as described at
http://wiki.videolan.org/ActiveX_Controls#Introduction:

"At some point, Microsoft Internet Explorer stopped allowing the
installation of ActiveX controls unless.. they were signed to
associate the software vendor's name with the file containing the
ActiveX control. ...  In a web configuration, a Certificate Authority
needs to digitally sign the ActiveX control. This comes at a cost
which the VideoLAN project is not able to bear."

On the Theora list, Cristian Adam said he's had good experiences with
the free Certum certificates:

http://lists.xiph.org/pipermail/theora/2009-August/002591.html

In particular, he showed that with the Cortado Java applet, IE
provides a very user-friendly message when the applet is signed with
the Certum cert:

http://ossguy.com/theora/cortado_signature_compare.png

I suspect a Certum cert would also work well for the VLC ActiveX
control.  Has the VLC project considered using one?

I'd be interested in seeing the VLC ActiveX control become reliable
and easy-to-use so we can solve the web video problem once and for
all.  I've talked about this in some detail at
http://ossguy.com/?p=424 ("Seamless web video within reach") if you're
interested.

Denver
http://ossguy.com/