nafyi.
Topics / Open-source software

Attributed viewpoint · Not a direct quote

VideoLAN compiles offline and uses double signatures

Jean-Baptiste Kempf says VideoLAN controls code entering VLC, compiles on machines that have never been connected to the internet, starts by compiling the compiler, and uses double signatures. He reports a suspected governmental attempt to put a fake binary on their servers, which frightened the team.

Jean-Baptiste Kempf·Published

Behind the viewpoint

Translations are for reading; original excerpts remain the evidence.

Jean-Baptiste Kempf on open-source code quality, maintenance and secure builds

Original excerpt

There is no code that gets into VLC that we don’t control, and the way we compile VLC, you would call me completely paranoid. Like, we compile on boxes that are offline, where we start by compiling the compiler. We do everything offline on places that have never been connected to the internet. We— The way we do signing, there is double signature.
Context

And what’s the definition of compromise? Like allowing a government to do a backdoor- I move to, I don’t know, Cayman Islands, and I change the domain name, and I start again, right? Like, VLC is a tool. It’s a tool that is going to help people doing things. We are not a platform. And for patents, well, I’m sorry, but most of the patents… Like, you shouldn’t be able to patent math and matrices. Like, this is wrong.

Open original · 3:53:19 (opens in a new tab)View source page

Start time comes from the supplied transcript. Playback alignment is awaiting review.