Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

blog.checkpoint.com

Post reply on HN
Print view View original

231–234 of 234 posts

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#231

Post by FranOntanaya »

amptorn wrote: post #214
FranOntanaya wrote: post #78

Earlier quoted context omitted.

> literally the easiest file format in existence to safely handle. Well, which one of them. There's nearly a hundred different subtitle formats, and each one has a whole set of variants. Just Timed Text alone (XML) can have more layouts than one could count, specially since it's meant to be able to replicate technically all previous industry formats.

> it's meant to be able to replicate technically all previous industry formats Even the DVD subtitle format, which is just a mostly transparent image overlaid on the picture? In XML ?

Yes, in the TTML2 spec https://www.w3.org/TR/ttml2/#embedded-content-vocabulary-chu...

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#232

Post by agnivade »

aruggirello wrote: post #136
_jomo wrote: post #9

These are the VLC commits adressing the issue: https://github.com/videolan/vlc/search?utf8=%E2%9C%93&q=subt...

I don't seem to find a way to update VLC to 2.2.5 on Ubuntu (or Debian, or Mint for the matter). I understand Canonical does not provide updates in the repos - but the VideoLAN website's download URL for Ubuntu is just "apt://vlc" - it would be nice to be able to download one or more .deb's too. Do we have to build it from source?

Damn, building from source is nigh impossible. Given the sheer amount of plugin libraries that need to be installed. - https://wiki.videolan.org/Contrib_Status/

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#233

Post by kutkloon7 »

FranOntanaya wrote: post #78
kutkloon7 wrote: post #46

The thing that most amazes my about Popcorn Time is how they find the subtitles. It seems to succeed even when I can't find subtitles myself. More related to the article, you would think that subtitles are literally the easiest file format in existence to safely handle. It's incredibly well-defined in terms of textual data and times.

> literally the easiest file format in existence to safely handle. Well, which one of them. There's nearly a hundred different subtitle formats, and each one has a whole set of variants. Just Timed Text alone (XML) can have more layouts than one could count, specially since it's meant to be able to replicate technically all previous industry formats.

Let me phrase it this way: one would expect that the class of file formats for subtitles are easiest to handle (as opposed to say, the class of file formats for images or videos).

On the other hand, images and videos are likely to be handled using some library, which might be better at safely handling the files.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#234

Post by muterad_murilax »

jbk wrote: post #165
zuck9 wrote: post #162

Earlier quoted context omitted.

Is that a default behavior or something you chose to do? What if there's a bigger security fix you need to push to people asap?

It is something that we chose to do. We usually let between 24hours and a few days before doing an upgrade, seeing the possible regressions. From tag to release to updates can take only 4hours, if we want enough mirrors.

Well, 10 days later and 2.2.4 is still shown as the latest version when trying to upgrade... :/
Post reply on HN