Should XBMC use system libraries when possible?
#1
This is in response to http://trac.xbmc.org/ticket/5416 since that ticket is becoming way too long and more of a religious discussion then a bug/feature ticket.

@candrews: I didn't mean to scare you off. There's no reason you can't learn and contribute.

@Xake: How is telling people they are on their own if they don't use specific versions any different than providing them with specific versions. And if Ubuntu upgrades their version, does that mean we no longer support the simple users who don't know how to install an older version? And how is it any better to force users to downgrade their libraries? Then they'll break other packages. The last thing we're going to do is give users a compile time option of using their system libraries or ours. Even if we say we don't support it, people will still come here asking for us to support it. If we're going to go that route we're going to go at it full force. And I do think it's a good thing to work toward, we just have to be careful how we do it.

Gimp may not have the full version of the source in their repo, but we're not Gimp so we're allowed to do it different. There is no harm in including the source in our repo. It especially helps with debugging. You don't know how many times I've had to go into Python to track down a crash. A feat which would not have been nearly as easy if we used the system library.

We're not even going to get into security. If you surf the Internet, you're done already. Perhaps we should take out all support for remote media since that has the highest probability of being malicious. Frankly I'd be more worried about buffer overruns in XBMC then in third party libraries.

I guarantee the changes we've made to Python cannot be pushed upstream. If you'd like to write the Python dev list and ask them to please not use certain functions, then by all means. But as I said to candrews, make sure you know what you're talking about before you go making these grand statements. The source is available, do a diff.
Always read the XBMC online-manual, FAQ and search the forum before posting.
Do not e-mail XBMC-Team members directly asking for support. Read/follow the forum rules.
For troubleshooting and bug reporting please make sure you read this first.
Reply
#2
@Xake -> "And sorry for maybe being a bit rude, but I find at least davilla's sense for security a bit bad. ".

It's easy to trivialize network security by a blanket statement about needing security updates. But all the security update in the world will not protect from a zero day exploit.

I only expose hardened boxes to the raw internet. I only stream/download from trusted sources. Anything else is unwise and sooner or later you (not me) will risk an exploit. 20+ years of dealing with computers and I've had one successful intrusion.

I for one, am not interested in playing the never ending catch game of security updates. If there's a serious problem, it will be addressed otherwise, the source code is in svn and you can apply any security patches yourself and build your own binaries.

To the other comments -> you are trivializing the build/debug/release process for a large multi-platform source code project. Any changes must consider the impact on osx ,linux, and windows platforms. Instead of just reading the readme for linux, also add the readme's for osx and windows before you start with criticism. And try to understand why certain libs are built and others are ref'd. Lumping them all together is not understanding their dependencies.

Stability is job #1 and part of that stability is controlling dependencies to a certain degree and that is done by using specific versions of some external libs. If you don't like this, then check out from svn and build your own binaries just the way you want them build.
Reply
#3
I'd love to help, cause I realize in this world, it's better to do than to whine. Perhaps someone can point me in the right directions to start doing the debundling work on a simple library, then I could take it from there? XBMC is just so huge, and complex (it's really impressive!), and the build system is likewise complex...

I think XBMC has a better chance of being included in distros this way, and that's really what I'd like to see. :-)
Reply
#4
I'd say start with cximage. Figure out if cximage is in Ubuntu. If not, many of the graphics libraries it links against are and should have a fairly stable interface. We already link against a few. See if we can link against them dynamically (by doing it and testing out viewing some pictures). This little exercise will hopefully get you acquainted with our system, and debundle a package in the process.
Always read the XBMC online-manual, FAQ and search the forum before posting.
Do not e-mail XBMC-Team members directly asking for support. Read/follow the forum rules.
For troubleshooting and bug reporting please make sure you read this first.
Reply
#5
Please look at this document to know how to wrap at runtime. http://lattice.umiacs.umd.edu/files/functions_tr.pdf .
This could solve the wrapping issue under linux.
Always read the XBMC online-manual, FAQ and search the forum before posting.
Do not e-mail XBMC-Team members directly asking for support. Read/follow the forum rules.
For troubleshooting and bug reporting please make sure you read this first.


Image

Want a clean no-ads paste bin? http://pastebin.ubuntu.com/
Reply
#6
All I got to say on the topic is this, please always keep in mind that XBMC is a multi-platform software so remember that all code should strive to be platform agnostic if and when at all possible.

I am not saying that platform specific code or features/functions are necessary bad but I think it makes it easier if XBMC is not too much dependent on platform specific library's, its probably more work but still better do have control over everything that XBMC depends on and therefor package that with XBMC.

My 2 cents
Always read the XBMC online-manual, FAQ and search the forum before posting.
Do not e-mail XBMC-Team members directly asking for support. Read/follow the forum rules.
For troubleshooting and bug reporting please make sure you read this first.
Reply
#7
Linux is the only platform where this really causes a problem. Windows doesn't have any of the libs we load by default. OSX libs are controlled by macports/fink. Linux has a billion distros with a billion different versions/patchlevels of libs.
Reply
#8
althekiller Wrote:Linux has a billion distros with a billion different versions/patchlevels of libs.

But those distros would probably not even think about packing/supporting xbmc in its current state with a lot of bundled libraries.

What Diego from Gentoo (and upstream xine-lib dev) thinks about it:
http://blog.flameeyes.eu/2009/01/02/bund...insecurity
Reply
#9
Very good article !
Always read the XBMC online-manual, FAQ and search the forum before posting.
Do not e-mail XBMC-Team members directly asking for support. Read/follow the forum rules.
For troubleshooting and bug reporting please make sure you read this first.


Image

Want a clean no-ads paste bin? http://pastebin.ubuntu.com/
Reply
#10
Xake Wrote:But those distros would probably not even think about packing/supporting xbmc in its current state with a lot of bundled libraries.

What Diego from Gentoo (and upstream xine-lib dev) thinks about it:
http://blog.flameeyes.eu/2009/01/02/bund...insecurity

What I said was in support of the changes. They aren't as pressing for win32 and osx because the libs are more tightly managed.
Reply
#11
Would it be possible to have XBMC use the system libraries if available, but fall back to bundled libraries where needed?

It would make maintenance easier on the XBMC side if our Linux libraries could be included entirely in the distro.
Reply
#12
I think that might be hard but Im unsure, recently I tried to move and link with libsmbclient-dev instead of our bundled version (like we did prior to hardy IIRC)

This is apt-getable and compiles but fails during linking as libsmbclient.a is busted in intrepid, this is a bad example but if not even ubuntu can keep its libraries working throughout the versions then its hard for us to use them Blush
If you have problems please read this before posting

Always read the XBMC online-manual, FAQ and search the forum before posting.
Do not e-mail XBMC-Team members directly asking for support. Read/follow the forum rules.
For troubleshooting and bug reporting please make sure you read this first.

Image

"Well Im gonna download the code and look at it a bit but I'm certainly not a really good C/C++ programer but I'd help as much as I can, I mostly write in C#."
Reply
#13
monkeyman Wrote:Would it be possible to have XBMC use the system libraries if available, but fall back to bundled libraries where needed?

It would make maintenance easier on the XBMC side if our Linux libraries could be included entirely in the distro.

Falling back is just as bad as including them in the first place. If something is busted or not included, we should know at compile time.
Always read the XBMC online-manual, FAQ and search the forum before posting.
Do not e-mail XBMC-Team members directly asking for support. Read/follow the forum rules.
For troubleshooting and bug reporting please make sure you read this first.
Reply
#14
Falling back was a poor choice of words on my part. I meant: should we include those libraries in builds for OSX and Windows since those libraries may not be available on those systems. However, for Linux, we could use the system libraries?

This probably is not very feasible since we're trying to build a cross-platform media center and consistency between our libraries is going to be critical.
Reply
#15
Consistency was the argument for including the libraries in the first place, but most of the libraries we include are stable enough to use the distro version in Linux. Windows and OSX are a different story since there's we can't reliably expect these libraries to be included.
Always read the XBMC online-manual, FAQ and search the forum before posting.
Do not e-mail XBMC-Team members directly asking for support. Read/follow the forum rules.
For troubleshooting and bug reporting please make sure you read this first.
Reply

Logout Mark Read Team Forum Stats Members Help
Should XBMC use system libraries when possible?0