[vlc-devel] [lua] Proposal for a standard-included playlistscript...

[Rémi Denis-Courmont]

Le lundi 20 août 2012 16:48:09 John Oyler, vous avez écrit :
> >> While this would still require some review, at least some of the scripts
> >> could be set as trusted by an automatic process...
> > 
> > That looks an awful lot like solving the halting problem to me. I dare
> > express my skepticism.
> 
> C'mon. If I give you a known safe lua script, and all you do is change
> the website url that it triggers for in probe(), and some minor regex
> twiddling in the parse()...

Lua, unlike regular expressions, is Turing-complete.

> It is not solving the halting problem for code (and simple code at
> that) to see that the new script is just as safe as the old.

It is basically as simple as a Lua parser. VLC used to have its own script 
interpreter. It was orders of magnitude simpler than Lua.  And yet it was too 
simple for the language to be convenient.

> Since a great many scripts might hold to such a pattern, the majority of
> submitted scripts might never need to be read by human eyes.

I am not going to believe that before I see the code. And if I ever see the 
code, I doubt that I will be comfortable running it on a public web server.

> And before anyone makes the claim that such scripts wouldn't be useful,

If it requires review by VLC developers, it does not bring much added value 
over the existing channels to deliver VLC Lua scripts.

> I can already demonstrate that this is not so and refer you to a few hundred
> people who want to see such functionality as viewers and a dozen who want it
> as "tv channel runners".

Oh, I am sure that lots of viewers would like the functionality. I am not so 
sure about the publishers. Playlist parsers tend to ignore advertisements. But 
I do not have much insight in that area. That is not my point of challenge.

My point is that someone would have to secure the VLC Lua environment first. 
Then VLC could run Lua safely just like browsers run Javascript.

-- 
Rémi Denis-Courmont
http://www.linkedin.com/in/remidenis