[vlc-devel] [PATCH] win32: do not load wininet.dll on startup, it's not a Known DLL

[Pierre Ynard]

> Filip and I objected to dynamically loading DLL - the patch at the
> top of this thread - because it adds complexity ("onion") and fixes
> literally nothing as far as VLC is concerned.

Agreed.

> Merging the manifest into the executable does not affect the source
> code. And while it agreeably does not fix any VLC bugs, it does
> "save" one file in the VLC installation, and mitigates the failure of
> anti-malware to detect manifest tampering.
>
> What is the concern with the manifest being inside or outside the
> executable?

Bundling together things that wouldn't need to be to "save" one
file isn't necessarily a good thing. Embedding the manifest makes
it marginally less easy to view and edit, which is bad from an open
perspective - but it has been argued it is a keystone of security. My
concern was also partially answered with:

> Any embedding manifest is visible through tools and properties of any
> application.

It's not a major concern in itself.

-- 
Pierre Ynard
"Une âme dans un corps, c'est comme un dessin sur une feuille de papier."