Our dav1d decoder makes it to Android as the default AV1 software decoder, providing improved performance and lower power consumption.
dav1d is one of the most sophisticated libraries ever built with over two hundred thousand lines of hand written assembly code!
If you wonder why we can't update the VLC on Android version, it's because Google refuses to let us update:
- either we give them our private signing keys,
- or we drop support for Android TV before API-30, and all our users on TV API<30 can't get fixes.
App Stores were a mistake.
Currently, we cannot update VLC on Windows Store, and we cannot update VLC on Android Play Store, without reducing security or dropping a lot of users...
For now, iOS App Store still allows us to ship for iOS9, but until when?
Because VLC works perfectly without our servers: we don’t collect info, we don’t require user accounts, we don’t spy on people (telemetry).
So once you have VLC, you don’t need our servers, for it to work.
Yes, it is sadly rare those days…
About the "security issue" on
#VLC
: VLC is not vulnerable.
tl;dr: the issue is in a 3rd party library, called libebml, which was fixed more than 16 months ago.
VLC since version 3.0.3 has the correct version shipped, and
@MITREcorp
did not even check their claim.
Thread:
If you do wonder why we don't update VLC on the Windows Store or why VLC/iOS can't connect properly to OneDrive shares, it's because Microsoft Kafkaïesque bureaucracy refuses to help us.
We're only trying to contact someone since 2years...
Any day now...
Yes, we still support iOS9 and 10 and we still see usage of those: an old iPad is still fine to watch videos.
Fight against premature obsolescence!
#greenIT
VideoLAN is 20 years old today!
In fact, 20 years ago today, VideoLAN moved from a closed-source student app to the GNU GPL, thanks to the authorization of the
@centralesupelec
director of that time.
VLC has grown a lot since, thanks to 1000 volunteers!
VLC is not written in Java, and is not vulnerable to the
#log4j
security issues.
Please stop sending emails asking this question: we don’t have time to answer all the emails incoming! 🥲
VLC is sending a cone to the moon! 🚀🚀🚀
VLC is sending a video time-capsule to the moon, for our 20th anniversary!
The time-capsule will be filled with YOUR videos and open source material.
Send your videos right now:
Thanks to
@astrobotic
and
@NASA
VLC 3.0.0 is out now!
It brings 4K/8K hardware decoding, 360 video & 3D audio, Network Share browsing, Chromecast, new subtitle rendering, HD codec Audio pass-through, complete Blu-ray menus, faster seeking and numerous new formats!
@sriksm19
And ?
That explains why you must download the official version and not a hacked version of VLC.
Banning the main website is exactly the opposite of what you want.
Would
@MITREcorp
behave the same way if we were Microsoft or another big company?
But no, we're just a small non-profit, that does not even have the money to pay someone fulltime...
End-of-thread.
and then, of course,
@Gizmodo
decided to play the clickbaiting of "Uninstall VLC now, or you are all going to die". Of course,
@Gizmodo
did not contact at all to check their info.
And then, we got hundreds of article about VLC insecurity.
If you wonder why we can't update the VLC on Android version, it's because Google refuses to let us update:
- either we give them our private signing keys,
- or we drop support for Android TV before API-30, and all our users on TV API<30 can't get fixes.
Tales from open source: “VLC has updates but not one of your fucking morons has applied a Dark Mode feature. My retinas are burning out of my fucking skull. You do not deserve to compete in a market, when you neglect your customers with such a SIMPLE FUCKING FEATURE AS DARK MODE.
If you do wonder why we don't update VLC on the Windows Store or why VLC/iOS can't connect properly to OneDrive shares, it's because Microsoft Kafkaïesque bureaucracy refuses to help us.
We're only trying to contact someone since 2years...
Any day now...
VLC 3.0.12 is now out!
Support for Apple Silicon (Mac M1) and Big Sur, improvements for DASH, RIST, Bluray support, fixes for macOS audio, Windows GPU, crashes and security issues.
VLC 3.0.18 has been pushed as an update to most VLC.
Numerous codecs and formats updates, improvements on support on formats (DVBsub/mkv, Flac, Hevc on AMD) and protocols (SMBv1/v2, FTP, HTTP2) and seeking improvements. And better compatibility for multichannel output on macOS.
You thought people could not go lower?
You thought wrong: people using our donation IBAN from our contribution page to pay their subscriptions for services…
This is not the first time that
@MITREcorp
does that.
In fact, they NEVER EVER contact us when they find security issues on VLC, and we always discover that after they are public, when a user or a distribution asks us.
PSA:
@HuaweiMobile
phones are now blacklisted and cannot get VLC on the Play Store.
Their ridiculous policy of killing all background apps (except their own) breaks VLC audio background playback (of course).
See and many other reports...
@HuaweiFr
@MITREcorp
So, a reporter, opened a bug on our bugtracker, which is outside of the reporting policy, aka, mail us in private on the security alias.
Of course, our bugtracker is public.
We could not, of course reproduce the issue, and tried to contact the security researcher, in private.
The reporter is using Ubuntu 18.04, which is an old version of Ubuntu, and clearly has not all the updated libraries.
But did not answer to our questions.
Any non-exploitable read overflow get CVSS of 9.8, like VLC is a server and you could do RCE and compromised the machine, while most of the time, the issue is a crash, often not exploitable, from a local file that the user HAS to open manually.
Then, this time, for whatever reason,
@certbund
decided to do an advisory , without checking either the crash (it's not hard), or the vulnerability, or even contacting us.
When we complained, and we asked if we could manage our own CVE (like another CNA), we had no answer and
@usnistgov
NVD told us that they basically couldn't do anything for us, not even fixing the wrong information.
If you do wonder why we don't update VLC on the Windows Store or why VLC/iOS can't connect properly to OneDrive shares, it's because Microsoft Kafkaïesque bureaucracy refuses to help us.
We're only trying to contact someone since 2years...
Any day now...
And the
@github
acquisition (potential) explains why we self-host all sourcecode at
@videolan
with git or with our
@gitlab
instance.
@Microsoft
has been a great citizen for open source lately, but it shows you can never know what will happen with a non-open-source SaaS.
Experts…
Blocking the main website will just push users to weirder websites, and therefore towards shady versions of VLC.
Those experts are incompetent…
@internetfreedom
@DoT_India
@GoI_MeitY
Based on my contacts in the Indian ISP space – They suspect (presume) that the so-called “experts” in the government seems to think that by blocking the official site, it will help curb malware that is spread via fake versions of
@videolan
#BabuLogic
@morthalys
@SwiftOnSecurity
We have people claiming bug bounties because our main ftp lists directories and because the source code is available!
(I wish it was a joke)
Instead of lowering the resolutions of videos, they should switch to better codecs like AV1:
AV1 gives a 50% gain over H.264 (still the king of codecs) and 25% over VP9/HEVC, for the same quality!
And of course, royalty free!
@RespectfulMemes
Thanks
@respectfulmemes
👊
While Jean Baptiste is the president of the VideoLAN non-profit, VLC is developed by a global community of volunteers.
You can support us here:
It was very difficult for us to get a certificate for Windows Authenticode and for Apple, as a French non-profit: we are not individual, not a US 501, not a company... It took us days to get them... And every expiration is a sweat.
Notepad++ 7.6.4 released without digital code-signing certificate as protest against the difficulty of open source projects obtaining them. Do we need a LetsEncrypt-style CA for code? (h/t
@nemokamui
)
Remember this?
The VLC time capsule is on the
@astrobotic
lander mounted on the
@ulalaunch
Vulcan rocket.
We'll be bringing you live coverage from Cape Canaveral this weekend!
VLC is sending a cone to the moon! 🚀🚀🚀
VLC is sending a video time-capsule to the moon, for our 20th anniversary!
The time-capsule will be filled with YOUR videos and open source material.
Send your videos right now:
Thanks to
@astrobotic
and
@NASA
Hey
@MITREcorp
and
@CVEnew
, the fact that you NEVER ever contact us for VLC vulnerabilities for years before publishing is really not cool; but at least you could check your info or check yourself before sending 9.8 CVSS vulnerability publicly...
And of course, in order to not have our families starve on the street, we are going to work right away on your very important feature… Because we did not think about it…
There will be more and more updates, with nothing improved except fixing your own bullshit mistakes. I'd be embarassed to work on such a piece of shit like this. Your families deserve to starve on the street, for your insolence.“
Thanks Tina, you are very nice.
Google is planning to push an update to Android phones that could dramatically improve AV1 video playback on budget devices. The March 2024 Play System Update may swap Google's libgav1 codec with
@videolan
's libdav1d codec.
Here's why that matters👇
🚨Exclusive: MeitY blocked VLC's website after it found it was communicating with servers of a previously banned app - Onmyoji Arena - which was transferring personal data of Indians to a “hostile country", an internal ministry note said
@IndianExpress
1/2
VLC 3.0.7 is out: minor release focused on security issues and minor annoyances/bugs.
This fixes more than 30 security issues, 2 being important, discovered thanks to the EU-FOSSA program done by
@EU_Commission
M1 chips are very fast.
Full decode of AV1 sample Chimera in 1080p using dav1d:
i9-9980H: 76/312/369fps
MacMini M1: 79/354/346fps
(Numbers are SingleThread; 4 Frame Threads with 4 Tiles Threads; and finally 8 Frame Threads with 4 Tiles Threads)
This is not a joke, we're actually sending it.
Time is limited to prepare the videos and material, RT appreciated.
@elonmusk
, please send us a video too!
And this is the perfect example why companies with lots of VC funding / big corpo, should support more open source core projects...
"Open"AI should know this...
we had a significant issue in ChatGPT due to a bug in an open source library, for which a fix has now been released and we have just finished validating.
a small percentage of users were able to see the titles of other users’ conversation history.
we feel awful about this.
VideoLAN isn't a real organization, it's an amalgamation of a bunch of developers groomed by state actors (China, US, etc.) to sneak vulnerabilities into VLC player
PA: we're sustaining a weird but continuous DDoS on our mirrors infrastructure.
However, it's a bit weird, since it's not that big, but clearly noticeable. And coming Worldwide.
So we're not sure what is happening yet.