[Alsaplayer-devel] cddb issues

[John Kelleher]

After some thought, I confess that I do not see the cddb issues in
AlsaPlayer as entirely minor. The current cddb fetch routine sort of
works, true, but I would like to bring the following points to your
attention.

1. I own CDs that are correctly fetched and parsed by xine, for
example, that are not found at all by AlsaPlayer. I reported one such
instance in my previous post about "svn 1240 and gtk2". So, completely
aside from parsing errors, the current cddb routine in AlsaPlayer does
not even fetch all the cddbs that are fetchable.

2. Last year, xine-libs had to do a re-make of their cddb code because
of a potentially serious security issue. Which is to say, even a cddb
fetch routine that had been used a lot and checked by many very
experienced eyes had a security flaw necessitating a code overhaul. I
suspect -- although I would be happy to have my concerns put to rest --
that AlsaPlayer's fetch routine has not been checked for security
issues as thoroughly as has xine-libs'.

Conclusions

a. The current AlsaPlayer fetch routine only 'sort of' works, and I do
not know whether it has been as thoroughly checked for security issues
as has, for example, the routine in xine-libs.

b. On the evidence, it is not that easy to write a 100-percent-accurate
and secure cddb-fetch routine. Even a big project like xine has had
problems.

c. a + b = some serious concerns, both about the current AlsaPlayer
cddb fetch routine, and about the possibility that some sort of simple
patch of the existing code will produce a good solution.

d. One possible approach would be not to try to fix the current
AlsaPlayer cddb fetch routine at all, but rather to drop it entirely as
a good first effort, and adapt something that has undergone much more
serious and extensive testing, such as the routine in xine-libs.

John Kelleher



      ____________________________________________________________________________________
Fussy? Opinionated? Impossible to please? Perfect.  Join Yahoo!'s user panel and lay it on us. http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7