Hi all, I'm still here just had a bit longer hiatus than planned. I got sick for a few weeks, was travelling to see family around both Thanksgiving and Christmas, had vacation in the middle, and before all of that I got a new desktop and really just finished setting up my development environment again.
This is going to be a
long one short novel, but I think it covers most of what I've missed.
RemiHiyama wrote: Wed Nov 24, 2021 9:08 am
I actually got a functioning build environment for this working, and think I understand enough of the coding side of things to start trying to fix some issues and add some features, but I don't really get git, so...
Ugh, I don't know what I'm trying to say. I mean, it's open source and so anyone can fork it at any time, but I don't want to step on any toes, you know?
Not stepping on toes at all, I moved the entire build process to GitHub actions for exactly this reason. Philo did amazing work, and I don't want to minimize that at all, but the build/release process was a bit complicated and hard for newcomers to get it going. The idea here was anyone can fork it and have working builds fully automated.
To add to that, I'm always open to help and pull requests. In fact I personally think having multiple people who know the code and regularly contribute is the best way to make sure the project keeps forward momentum and relies less on a single person.
RemiHiyama wrote: Mon Nov 29, 2021 6:56 am
Not just hasn't posted, according to user statistics he hasn't done anything on the site since August, which is the sort of thing that makes me wonder if maybe he's just moved on.
Yeah, I should do better about actually logging in... Since the forums are public I usually just browse the forums and don't login unless I'm replying or need to access DMs, and I get email notifications for those.
RemiHiyama wrote: Wed Dec 08, 2021 6:34 am
I've got this idea that it'd be much more pleasant to write this:
Code: Select all
addButton({target: "exit", text: "Stop", hotkey: "s"})
than this:
Code: Select all
addButton("exit", "Stop", "", "", "", "", "s")
It's interesting that you mention this format of using JS objects instead of multiple parameters. I had this same idea, and I would love to see this implemented. Since JS doesn't support function overloading it's not easy to have multiple functions with one or two parameters. With passing an object like this is becomes easy and I think it would make for much easier JS development for tease authors.
Remi, huge thanks for the Log4J updates. I had to deal with this across dozens of applications at work and it has been a complete pain in the ass. The update itself it pretty straightforward, but the scope of impact on this one was huge. I have the added benefit of applications that require HIPAA, PCI, and other regulatory requirements that make this even more sensitive. I agree with your assessment on impact here - overall less likely to be exploited in our usage, but it definitely opens up a potential privacy issue and that alone is a reason to get it patched quickly. Apologies I did not get to this sooner, and thank you again for working on this. I've made multiple updates to try to keep vendor libraries up to date, and I'm not aware of any other security vulnerabilities, but it's worth re-iterating what you mentioned here:
RemiHiyama wrote: Tue Dec 14, 2021 4:36 am
Also, keep in mind that GuideMe is not a secure sandbox. I'm not aware of any other code execution vulnerabilities, but a guide can still send data to any web server it wants via ordinary html. Use caution with teases made by people you don't know, and I recommend not entering your real name or other personally identifiable information into GuideMe.
Given the nature of the program it would be very difficult if not impossible to fully protect against malicious teases. As Remi said, it's good to exercise caution when using teases from people you don't know. The nice thing is the teases can be reviewed and I would hope anything malicious would be spotted and removed fairly quickly.
RemiHiyama wrote: Tue Dec 21, 2021 4:01 am
Hmmm. I did some searching for that option and found this issue in vlcj's github:
https://github.com/caprica/vlcj/issues/929
And it's fixed... in vlcj-4.4.2 and up.
GuideMe currently uses 3.12.1
That may not be a trivial upgrade.
It's a pretty miserable upgrade, but one I want to do for a number of other reasons in addition to this. It has been on my list to work on as well. I think this update would be made much easier by creating some new classes for the audio and video players that aren't as tied in to the main UI classes.
RemiHiyama wrote: Fri Dec 24, 2021 6:38 pm
So I decided to do some searching for vlcj unexpectedly opening new windows, and found some pages saying that happened when there was an issue with a window handle (or window surface, or something like that) being invalid.
There's some weirdness around the window handle and video surface for VLC, so I'm not terribly surprised here. To be honest, this part of the application needs some TLC. I think most of this will resolve itself if we update VLCj, because new versions have different requirements for the window handle and video surface, but we'll see.
Now, for what's next. Remi, if you have other items you're working on, please feel free to create issues as needed, comment on ones you're working on, and open merge requests etc. I'll try to clean up any of these you've resolved as I merge code back up. If you have interest in contributing to the development I'll gladly take the help, and I think it would benefit everyone if we have multiple people working on it.
I'm going to merge most if not all of what Remi has done back into my repo and tag the release(s). At a minimum, I'll tag a newer release that has the Log4J updates. I may need to adjust some version tags slightly. While I like the approach of having a release number and/or alpha build number, the block of code that processes the app version needs some work and only accepts a 3-part version like X.X.X, so it may not properly check app versions. Versions like 0.4.5.1 may not be interpreted as we'd like, and this may need to become 0.4.6. I want to replace this code with an actual Semver library that can read alpha/beta tags properly as well, so if time allows maybe I'll try to get that added and keep your version number.
I think we have a few options here going forward, and I'd really like some other opinions. Should we just drop the leading 0 and move to 4.5.1 etc? I'm inclined to go this route since this is how everyone has been referring to versions and at least to me going to 1.X would just be confusing.