[vlc-devel] [lua] Proposal for a standard-included playlistscript...

[John Oyler]

On Fri, Aug 17, 2012 at 9:06 AM, Robert Forsman
<bob.forsman at ericsson.com> wrote:
> On Wed, 15 Aug 2012 16:04:33 -0400
> John Oyler <john.m.oyler at gmail.com> wrote:
>
>> Install this: http://75.109.71.79:8000/~john/spacepotato/spacepotato.lua
>> Then open this: http://75.109.71.79:8000/~john/spacepotato/
>
>   I would solve that problem using MPEG DASH or Apple HLS.
>
> MPEG DASH makes it pretty easy to specify a string of media files and
> when they start airing.  it also supports re-loading the manifest
> (MPD) to pick up new <Period>s.
>
> I don't know if VLC's implementation of DASH has been expanded to
> support those features of the spec, but it is probably easier than
> securing a LUA environment.

Dash looks like streaming. I'm not streaming any video. People who want to
stream video spend thousands each month on bandwidth.

As for securing lua, I've already got that figured out. Supposing I can convince
everyone here, the trick would be to have the downloader script md5 the file
and check back to a webapp at http://videolan.org whether this md5 is trusted.
If it is, it installs it, if not, it discards it.

While this would still require some review, at least some of the scripts could
be set as trusted by an automatic process... a safe script would be one that
only returns true in probe() for a single specific web address that also happens
to be new (and not someone trying to hijack youtube.com), and one that
doesn't make use of the filesystem access or other unsafe statements.