Nabble - MusicBrainz

Re: new rev

2008-10-15T20:01:33Z

Let me just dump a few thoughts about the status quo
of XSPF here. Feedback is appreciated.

== In this mail ==
1. Location ranking
2. Location mime type
3. Tag spelling fixes
4. Broken attribution concept

== 1. Location ranking ==
For a track with several locations it's currently not
possible for an XSPF processor (e.g. audio player)
to tell which location will likely result in the
best human experience. It's not possible because
(native) XSPF does not allow specifying a quality
ranking of a location explicitly and because there
is not defined implicit ranking.

How about defining an implicit ranking like this:

Where several locations are given the quaility
should decrease from first to last, so the highest
quality version always comes first. This way
software only working with the first entry will
not result in a reduced user experience.

For multimedia files (e.g. combined video and
audio) quality should be ranked with respect
to the dominant component of that file.
For instance for a clip of somebody reading
the news, audio might be the dominant component
while video might be the dominant component
for a dancing competition recording.

== 2. Location mime type ==
Let's say you run a Linux distribution which for legal
reasons comes without support for MP3 decoding. Some do,
I think Fedora is one of them, not sure.
If a track's location would carry mime type information
with it, an audio player taking care could ignore a
location pointing to an MP3 file as it cannot play it
anyway.

== 3. Tag spelling fixes ==
Today I noticed again how bad <trackNum> and <trackList>
fit into an otherwise consistently lowercase naming.
Especially <trackList> and <playlist> together bite hard.
If there ever is a successor to XSPF-1 I personally
want (backwards-compatible) support for <tracknum>
and <tracklist> tags.

== 4. Broken attribution concept ==
With the current concept of attribution support
a derivative playlist is created by moving
either the playlist's <identifier> or <location>
into <aatribution>, e.g.

<playlist ...>
...
<creator>Leonardo</creator>
...
<identifier>v1_identifier</identifier>
...
</playlist>

is extended to

<playlist ...>
...
<creator>Mona Lisa</creator>
...
<identifier>v2_identifier</identifier>
...
<attribution>
<identifier>v1_identifier</identifier>
</attribution>
...
</playlist>

Notice that <creator> is holding the name of the author
of the latest version of the playlist file, same applies
to <license>. To find out the creator or license of
any earlier version one has to find an original copy
of this very version's file and look it up from the inside.
In some or even many cases this might work, but what
if this original version has been moved or even deleted?
In that case neither license nor author can be determined.

That's not cool. I'm aware attribution probably is one
of the least-used features of XSPF but as it seems
inherently broken I feel like we have to fix it on the
next occasion. How do you feel about this?
Is there a way to fix this backwards-compatibly?

Sebastian

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

From forum: MusicBrainz - Playlist

Re: explicit vs. clean content

2008-10-15T19:45:34Z

Am Freitag, 10. Oktober 2008 schrieb Dustin B:
> Unfortunately, the content is often *not* different enough to
> generate different PUIDs, at least with what I have.

Thank you. This is the experience I was asking for. Since I don't know
if the content is actually different enough (a PUID is a good
criterion), I don't duplicate this one.

--
JonnyJD

_______________________________________________
MusicBrainz-users mailing list
MusicBrainz-users@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-users

signature.asc (204 bytes) Download Attachment

From forum: Musicbrainz - Users

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T18:49:33Z

Lucas Gonze wrote:
> Seems like their use of "identifier" is really to do what the xml:id
> attribute does already, and not what an XSPF identifier does. So
> here's what I'm wondering: given that xml:id is a freebie with XML and
> doesn't need to be defined by XML-based data formats like XSPF, what
> could VLC be using instead of their extension to refer to those IDs?

In 0.9.4 it seems they move from using <identifier> to <vlc:id>
wrapped by an <extension> like this:

<playlist ...>
...
<trackList>
<track>
...
<extension ...>
<vlc:id>0</vlc:id>
</extension>
</track>
<track>
...
<extension ...>
<vlc:id>1</vlc:id>
</extension>
</track>
</trackList>
<extension ...>
<vlc:node title="title of my playlist">
<vlc:item tid="0" />
<vlc:item tid="1" />
...
</vlc:node>
</extension>
</playlist>

A minimal conversion using xml:id could result in something like

<playlist ...>
...
<trackList>
<track xml:id="0">
...
</track>
<track xml:id="1">
...
</track>
</trackList>
<extension ...>
<vlc:node title="title of my playlist">
<vlc:item tid="0" />
<vlc:item tid="1" />
...
</vlc:node>
</extension>
</playlist>

I'll have to fix libSpiff to support this but that should not keep
them from doing it right.

Sebastian

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

From forum: MusicBrainz - Playlist

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T18:31:44Z

Robert Buchholz wrote:
> This is VLC #1244 [ https://trac.videolan.org/vlc/ticket/1244 ], which
> is closed.

I think you're mixing up relative path support with a privacy
issue here.

Sebastian

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

From forum: MusicBrainz - Playlist

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T18:31:19Z

Just opened...

[0.9.4] XSPF output hurts privacy
https://trac.videolan.org/vlc/ticket/2217

[0.9.4] XSPF output carries invalid URIs
https://trac.videolan.org/vlc/ticket/2218

Sebastian

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

From forum: MusicBrainz - Playlist

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T18:25:11Z

On Thursday 16 October 2008, Sebastian Pipping wrote:
> Also the written file contains the absolute path to the
> file itself in //playlist.location. For file on a website
> this might be a good idea but for local files its much
> more a privacy issue. I've seen this with Inkscape before.

This is VLC #1244 [ https://trac.videolan.org/vlc/ticket/1244 ], which
is closed.

Robert

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

signature.asc (852 bytes) Download Attachment

From forum: MusicBrainz - Playlist

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T18:20:14Z

On Wednesday 15 October 2008, Lucas Gonze wrote:
> Though it's worth pointing out that there is an error in the
> understanding of XSPF: "The identifier attribute is a numeric value
> that indicates the position of the track in the tracklist. " They're
> thinking of the trackNum element, which indicates the position of a
> recording from an album in the original album sequence.

This is VLC #1421 [ https://trac.videolan.org/vlc/ticket/1421 ]

Robert

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

signature.asc (852 bytes) Download Attachment

From forum: MusicBrainz - Playlist

Re: Should we change automod elections to require a two-thirds majority?

2008-10-15T18:12:07Z

Crazee_Canuck wrote:

> * Gioele <gioeleb@...> [2008-16-10 01:21 EEST]:
>
>> On Wed, Oct 15, 2008 at 11:39 PM, symphonick <symphonick@...> wrote:
>>
>>> Perhaps we could try setting some thresholds you have to pass before
>>> you can be nominated? Say at least 1000 edits & 1000 votes? & possibly
>>> a time limit too, active for at least 3 months or something?
>>>
>> Maybe what we really need is new discussion about the Autoeditor
>> status: what should be done to get it? What makes you worth of that
>> status? Is there a way to become unsuitable for the autoeditor status?
>> What should we do when you're not suitable anymore?
>>
>> And bit more in depth:
>> Is the edits count important?
>> Is the votes count important?
>> How do we evaluate the quality of the edits and of the votes?
>>
>> Yes, maybe these questions are more important than what threshold should we set.
>>
>
> +1
> ------------------------------------------------------------------------

This has all been discussed in detail before, around the time earlier
this year of the reasonably heavily criticised (on some sides)
autoeditor nomination spree - there's no one size fits all set of
metrics that can indicate if someone will make a good AutoEditor.

Edits can be full of trivial add rels; add PUIDs etc. An autoeditor
should understand nearly all the edit types and have a variety of them
which is more difficult for the average autoeditor to judge. Votes are
important, but not critical. Most important (IMO), is how that editor
interacts with others. Will they correct mistakes, have they shown a
keenness to learn MB's real purpose, take part in other forums etc? Do
they help others on edits, do they interact with other editors in a
net-positive manner? Metrics can't assess all this, and if it were
possible to assess all these things objectively there'd be no point in
having a voting system in the first place, would there?

However, guidelines for things that may indicate a good AutoEditor
nomination is a /separate/ issue to this, I believe. All of the
candidates that may have failed a 66% election probably looked good on
paper, had lots of edits, some votes etc. It takes that extra digging,
and judgement from AutoEditor's encounters with that person on edits
that creates a place for the human judgement aspect of the voting
process. Otherwise we wouldn't have it, would we?

I'm still yet to see anyone discuss concrete or theoretical downsides to
this proposal other than Rob's concerns that it may set the bar too
high. My response to this was that failure doesn't remove the ability
for the candidate to be re-nominated at a later point, (as has happened
before, and possibly should have happened with several elections of the
past year). Anyone committed to MB should still be around 3-6 months
later when the time may be right.

Chad

_______________________________________________
MusicBrainz-automods mailing list
MusicBrainz-automods@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-automods

From forum: MusicBrainz - Automods

r10482 - mb_server/trunk/htdocs/show/stats

2008-10-15T18:01:16Z

Author: robert
Date: 2008-10-16 01:01:16 +0000 (Thu, 16 Oct 2008)
New Revision: 10482

Modified:
mb_server/trunk/htdocs/show/stats/mb_history.xml
Log:
Fleshed out 2003, 2006 and 2008

Modified: mb_server/trunk/htdocs/show/stats/mb_history.xml
===================================================================
--- mb_server/trunk/htdocs/show/stats/mb_history.xml 2008-10-16 00:25:19 UTC (rev 10481)
+++ mb_server/trunk/htdocs/show/stats/mb_history.xml 2008-10-16 01:01:16 UTC (rev 10482)
@@ -1,9 +1,39 @@
<?xml version="1.0" encoding="UTF-8"?>
<data>
- <event start="Oct 13 2003" title="Edit search" link="http://blog.musicbrainz.org/?p=18">
+ <event start="Jan 21 2003" title="TRM collisions" link="http://blog.musicbrainz.org/?p=4">
+ Added support for improved TRM collision handling in the classic tagger.
+ </event>
+ <event start="Mar 02 2003" title="Cleanup" link="http://blog.musicbrainz.org/?p=4">
+ Bug fix/cleanup release.
+ </event>
+ <event start="Mar 29 2003" title="Dedicated database server" link="http://blog.musicbrainz.org/?p=5">
+ MusicBrainz gets its first dedicated database server.
+ </event>
+ <event start="Apr 05 2003" title="Improved search" link="http://blog.musicbrainz.org/?p=6">
+ Improved search/cleanup.
+ </event>
+ <event start="Jun 07 2003" title="Cleanup" link="http://blog.musicbrainz.org/?p=9">
+ Cleanup release.
+ </event>
+ <event start="Jun 15 2003" title="Cleanup" link="http://blog.musicbrainz.org/?p=10">
+ Cleanup release.
+ </event>
+ <event start="Jun 30 2003" title="Artist subscriptions" link="http://blog.musicbrainz.org/?p=11">
+ Artist subscriptions
+ </event>
+ <event start="Jun 30 2003" title="Bug fixes" link="http://blog.musicbrainz.org/?p=13">
+ Bug fix/cleanup release.
+ </event>
+ <event start="Jul 25 2003" title="Bug fixes" link="http://blog.musicbrainz.org/?p=15">
+ Bug fix/cleanup release.
+ </event>
+ <event start="Sep 04 2003" title="Bug fixes" link="http://blog.musicbrainz.org/?p=16">
+ Bug fix/cleanup release.
+ </event>
+ <event start="Oct 13 2003" title="Non album tracks" link="http://blog.musicbrainz.org/?p=18">
Non album tracks are released.
</event>
- <event start="Oct 19 2003" title="Edit search" link="http://blog.musicbrainz.org/?p=19">
+ <event start="Oct 19 2003" title="Release editor" link="http://blog.musicbrainz.org/?p=19">
Release editor and Guess Case released.
</event>
<event start="Nov 10 2003" title="Edit search" link="http://blog.musicbrainz.org/?p=21">
@@ -52,6 +82,9 @@
<event start="Jan 08 2006" title="SG5 Fixes" link="http://blog.musicbrainz.org/?p=142">
Style Guideline 5 workaround introduced and unused TRMs pruned from the database.
</event>
+ <event start="Jan 20 2007" title="MetaBrainz signs first customer" link="http://blog.musicbrainz.org/?p=148">
+ Linkara Musica becomes first commercial customer of MetaBrainz.
+ </event>
<event start="Feb 27 2006" title="MusicBrainz Move" link="http://blog.musicbrainz.org/?p=155">
MusicBrainz moved to Digital West Networks in San Luis Obispo.
</event>
@@ -62,12 +95,39 @@
MusicBrainz partners with MusicIP and starts using MusicDNS's PUID acoustic fingerprints.
</event>
<event start="Jul 12 2006" title="Release editor" link="http://blog.musicbrainz.org/?p=184">
- An improved release editor and a new site design are released and welcomed with a Great Debate.
+ An improved release editor and a new site design are released.
</event>
+ <event start="Aug 15 2006" title="Great Dispute" link="http://wiki.musicbrainz.org/GreatDispute">
+ A rift in the MusicBrainz community leads to a Great Dispute.
+ </event>
+ <event start="Dec 17 2006" title="Search improvements" link="http://blog.musicbrainz.org/?p=229">
+ The search features and web service improvements are released.
+ </event>
<event start="Apr 01 2007" title="Labels/data quality" link="http://blog.musicbrainz.org/?p=252">
Support for Labels and data quality are released.
</event>
+ <event start="Jun 28 2007" title="BBC partners with MetaBrainz" link="http://blog.musicbrainz.org/?p=274">
+ The BBC becomes a MetaBrainz customer and starts using MusicBrainz data.
+ </event>
<event start="Oct 17 2007" title="Tags" link="http://blog.musicbrainz.org/?p=287">
Folksonomy tagging, editor subscriptions are released.
</event>
+ <event start="Nov 07 2007" title="Last.fm" link="http://blog.musicbrainz.org/?p=294">
+ Last.fm signs up with MetaBrainz and starts using MusicBrainz data.
+ </event>
+ <event start="Apr 01 2008" title="MetaWeb signed" link="http://blog.musicbrainz.org/?p=316">
+ MetaWeb comes MusicBrainz data user.
+ </event>
+ <event start="Apr 21 2008" title="SoC 2008" link="http://blog.musicbrainz.org/?p=317">
+ MetaBrainz accepts three students for Google Summer of Code.
+ </event>
+ <event start="Jul 30 2008" title="BBC dynamic artist pages" link="http://blog.musicbrainz.org/?p=337">
+ BBC launches the dynamic artist pages based on MusicBrainz data.
+ </event>
+ <event start="Sep 01 2008" title="Amazon betas SoundUnwound" link="http://blog.musicbrainz.org/?p=344">
+ Amazon betas <a href="http://soundunwound.com">SoundUnwound</a> with data from MusicBrainz.
+ </event>
+ <event start="Sep 23 2008" title="MetaBrainz hires Oliver Charles" link="http://blog.musicbrainz.org/?p=346">
+ Oliver Charles becomes employee #1 of MetaBrainz Foundation.
+ </event>
</data>

_______________________________________________
MusicBrainz-commits mailing list
MusicBrainz-commits@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-commits

From forum: musicbrainz-commits

r10481 - mb_server/trunk/htdocs/show/stats

2008-10-15T17:25:19Z

Author: robert
Date: 2008-10-16 00:25:19 +0000 (Thu, 16 Oct 2008)
New Revision: 10481

Modified:
mb_server/trunk/htdocs/show/stats/zeitgeist-data.html
Log:
Add server side caching for the stats. Haven't figured out how to convince the client
to cache data.

Modified: mb_server/trunk/htdocs/show/stats/zeitgeist-data.html
===================================================================
--- mb_server/trunk/htdocs/show/stats/zeitgeist-data.html 2008-10-15 23:36:43 UTC (rev 10480)
+++ mb_server/trunk/htdocs/show/stats/zeitgeist-data.html 2008-10-16 00:25:19 UTC (rev 10481)
@@ -31,12 +31,19 @@
</%args>
<%perl>

-my $mb = $m->comp("/comp/dblogin");
-my $stats = MusicBrainz::Server::Statistics->new($mb->{DBH});
-
return if (!$series);

-$m->out($stats->GetStats($series));
+my $data = $m->cache->get("zeigeist-$series", busy_lock=>'30 sec');
+if (!defined $data)
+{
+ my $mb = $m->comp("/comp/dblogin");
+ my $stats = MusicBrainz::Server::Statistics->new($mb->{DBH});
+
+ $data = $stats->GetStats($series);
+ $m->cache->set("zeigeist-$series", $data, "2h");
+}
+
+$m->out($data);
$m->out("\n");

</%perl>

_______________________________________________
MusicBrainz-commits mailing list
MusicBrainz-commits@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-commits

From forum: musicbrainz-commits

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T17:18:40Z

Lucas Gonze wrote:

> Sebastian Pipping wrote:
>> I just checked. VLC 0.9.4 gives me locations like this:
>>
>> <location>file://C%3A\foo\bar.mp3</location>
>>
>> Sigh, valid URIs cannot be that hard...
>
>
> I just got this from 0.9.4 on XP:
> <location>C:\Documents%20and%20Settings\Owner\My%20Documents\test.xspf</location>

Right, the playlist location doesn't even start with "file://".
The track locations do. So we have two levels of URI invalidity
in a single file. :-)

Sebastian

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

From forum: MusicBrainz - Playlist

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T17:15:44Z

Sebastian Pipping wrote:
> I just checked. VLC 0.9.4 gives me locations like this:
>
> <location>file://C%3A\foo\bar.mp3</location>
>
> Sigh, valid URIs cannot be that hard...

I just got this from 0.9.4 on XP:
<location>C:\Documents%20and%20Settings\Owner\My%20Documents\test.xspf</location>

The problem as always is convincing people who work on media players
that playlists are internet media types which ought to be shareable.
VLC's way of doing this works fine as long as only VLC is going to open
the playlists it creates.

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

From forum: MusicBrainz - Playlist

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T17:02:37Z

Ivo Emanuel Gonçalves wrote:
> When I tested last year it was both, but supposedly it got fixed, so
> I'll say it's only while writing.

I just checked. VLC 0.9.4 gives me locations like this:

<location>file://C%3A\foo\bar.mp3</location>

Sigh, valid URIs cannot be that hard...

Also the written file contains the absolute path to the
file itself in //playlist.location. For file on a website
this might be a good idea but for local files its much
more a privacy issue. I've seen this with Inkscape before.

So I guess that's two bugs to open.

Sebastian

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

From forum: MusicBrainz - Playlist

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T16:57:12Z

>> <track>
>> <identifier>0</identifier>
>> ...
>> </track>
>> </trackList>
>> <extension application="http://www.videolan.org/vlc/playlist/0">
>> <item href="0" />
>> </extension>

Seems like their use of "identifier" is really to do what the xml:id
attribute does already, and not what an XSPF identifier does. So
here's what I'm wondering: given that xml:id is a freebie with XML and
doesn't need to be defined by XML-based data formats like XSPF, what
could VLC be using instead of their extension to refer to those IDs?

BTW, it is interesting to notice that their extension creates a format
with the same shape as iTunes library XML. Seems to be one of those
patterns that crops up in nature on its own.

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

From forum: MusicBrainz - Playlist

r10480 - in mb_server/trunk/htdocs: css show/stats

2008-10-15T16:36:43Z

Author: robert
Date: 2008-10-15 23:36:43 +0000 (Wed, 15 Oct 2008)
New Revision: 10480

Modified:
mb_server/trunk/htdocs/css/main.css
mb_server/trunk/htdocs/show/stats/zeitgeist.html
Log:
Added a URL addressability of the graph type and plot lines. Added a link to this page.

Modified: mb_server/trunk/htdocs/css/main.css
===================================================================
--- mb_server/trunk/htdocs/css/main.css 2008-10-15 20:39:51 UTC (rev 10479)
+++ mb_server/trunk/htdocs/css/main.css 2008-10-15 23:36:43 UTC (rev 10480)
@@ -1218,11 +1218,13 @@

/* Styles for the zeitgeist */
#stats-timeplot-title {
- font-weight: bold;
+ font-weight: bold;
}
#stats-timeplot-legend a {
text-decoration: none;
color: #000000;
}
-
+#stats-timeplot-link-to-this {
+ float: right;
+}
/* vi: set ts=4 sw=4 ft=mason : */

Modified: mb_server/trunk/htdocs/show/stats/zeitgeist.html
===================================================================
--- mb_server/trunk/htdocs/show/stats/zeitgeist.html 2008-10-15 20:39:51 UTC (rev 10479)
+++ mb_server/trunk/htdocs/show/stats/zeitgeist.html 2008-10-15 23:36:43 UTC (rev 10480)
@@ -26,6 +26,10 @@
# $Id: permlink.html 8548 2006-10-19 07:41:02Z dave $
#
</%perl>
+<%args>
+ $type => 'artist'
+ $lines => '11111'
+</%args>
<%perl>

my $head = <<'EOT';
@@ -84,15 +88,21 @@
var linesVisible = [1, 1, 1, 1, 1];
var currentType = 0;

-function onLoad()
+function loadGraph(type, showLines)
{
- loadGraph("artist");
-}
+ if (showLines == null)
+ {
+ for(i = 0; i < maxPlotLines; i++)
+ linesVisible[i] = 1;
+ }
+ else
+ {
+ for(i = 0; i < maxPlotLines; i++)
+ linesVisible[i] = (showLines[i] == '1');
+ }

-function loadGraph(type)
-{
- for(i = 0; i < maxPlotLines; i++)
- linesVisible[i] = 1;
+ if (types[type] == null)
+ type = 'artist';
currentType = type;

plotGraph();
@@ -110,6 +120,7 @@
series[i] = plots[i][1];
}

+ // set up the plot
var eventSource = new Timeplot.DefaultEventSource();
var historySource = new Timeplot.DefaultEventSource();

@@ -143,6 +154,7 @@
eventSource: historySource,
lineColor: "#EDA5C2"});

+ // Now create the actual plot
timeplot = Timeplot.create(document.getElementById("stats-timeplot"), plotInfo);
timeplot.loadText("zeitgeist-data.html?series=" + series.join(","), ",", eventSource);
timeplot.loadXML("mb_history.xml", historySource);
@@ -150,6 +162,7 @@
textContent = document.getElementById('stats-timeplot-title')
textContent.firstChild.data=title;

+ // Update the legend
var legend = "";
for(i = 0; i < plots.length; i++)
{
@@ -173,6 +186,13 @@
node = document.getElementById('legend-text-' + i)
node.firstChild.data= " ";
}
+
+ // Update the link to this link
+ node = document.getElementById('stats-timeplot-link-to-this')
+ href = "?type=" + type + "&lines=";
+ for(i = 0; i < maxPlotLines; i++)
+ href += linesVisible[i] ? '1' : '0';
+ node.href = href
}

function toggle(plotNum)
@@ -197,7 +217,7 @@
EOT
</%perl>

-<& /comp/sidebar, pagetitle => "MusicBrainz Zeitgeist", body=>'onload="onLoad();" onresize="onResize();"', head => $head &>
+<& /comp/sidebar, pagetitle => "MusicBrainz Zeitgeist", body=>'onload="loadGraph(\''.$type.'\', \''.$lines.'\');" onresize="onResize();"', head => $head &>

<p>
View [ <a href="#" onclick="loadGraph('artist');">artist/album</a> |
@@ -210,6 +230,7 @@

<div id="stats-timeplot-title"> </div>
<div id="stats-timeplot" style="height:200px;"></div>
+<a id="stats-timeplot-link-to-this" href="#">link to this graph</a>
<div id="stats-timeplot-legend">
<span id="legend-color-0"> </span><a id="legend-text-0" href="#" onclick="toggle(0);" class="shownplotline"> </a>
<span id="legend-color-1"> </span><a id="legend-text-1" href="#" onclick="toggle(1);" class="shownplotline"> </a>

_______________________________________________
MusicBrainz-commits mailing list
MusicBrainz-commits@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-commits

From forum: musicbrainz-commits

Re: [mb-bugs] [MusicBrainz Bug Tracker] #3985: Unreadible tags in M4A

2008-10-15T16:25:59Z

#3985: Unreadible tags in M4A
-------------------------------------------------+--------------------------
Reporter: Guhndahb | Owner:
Type: bug | Status: new
Priority: normal | Milestone:
Component: Picard Tagger | Version: Picard 0.10.0
Resolution: | Keywords:
Browser: Netscape, Firefox, Mozilla (Gecko) | Os: Windows XP
-------------------------------------------------+--------------------------
Comment (by Guhndahb):

I forgot to mention in the original report that performing the same steps
except encoding a MP3 w/ lame.exe or a FLAC w/ flac.exe results in files
with tags that read just fine in foobar2000. It's only M4As that exhibit
this.

--
Ticket URL: <http://bugs.musicbrainz.org/ticket/3985#comment:1>
MusicBrainz Bug Tracker <http://musicbrainz.org>
MusicBrainz -- the music metadatabase
_______________________________________________
Musicbrainz-bugs mailing list
Musicbrainz-bugs@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-bugs

From forum: musicbrainz-bugs

Re: Should we change automod elections to require a two-thirds majority?

2008-10-15T15:53:55Z

Chad Wilson wrote:

> StoneyBoh wrote:
>
>> If folks want to change to a 2/3 majority that is fine with me, but I
>> don't think this does anything substantial to changing the current
>> dynamic of elections. It seems to me that this has been proposed as a
>> solution, when the problem statement has not been clearly stated.
>>
>> I interpret the "problem" that some folks believe that there is an
>> unwritten "code" among editors that only elections where there is a
>> near-unanimous approval should be "counted" or allowed to completion.
>> (Although that doesn't seem to be documented anywhere.) Others abide by
>> the fact that a simple majority vote is fine. Is this the problem we
>> are trying to solve?
>>
> This "problem" as you describe it, is a community-evolved understanding.
> Many facets of community understandings are not documented, and that
> doesn't make them unreal. The large influx of new AutoEditors who are
> now more vocal than the more longstanding ones has lead to this
> understanding weakening and being drowned in the noise.
>

Please be careful here, your implication is that newer community members
who may not have yet found the secret decoder ring are just spouting
noise, which certainly isn't true.

In a constantly changing community, undocumented understandings are not
understandings at all. At best they lead to confusion and at worst can
lead to ill feelings and frustration. I agree that the process of
electing autoeditors is one of the most important we have - we can't
rely on undocumented understandings to control the process.

> Consider that most of an AutoEditor's edits will not get /any/ review by
> anyone else until accidentally much later in time, so seeing that an
> AutoEditor has made "bad" edits is almost certainly a delayed process.
> Many experienced editors who edit widely across the DB, and tending to
> dig through history a lot have raised concerns about some aspects of
> editing by the batch of newer AutoEditors.
>
> This does not make their elections "bad"; but possibly too early, too
> much inexperience or similar. We don't really have a mechanism for
> resolving such problems and it's embarrassing for MB and frustrating for
> other AutoEditors to have editors with such privileges making lots of
> incorrect edits from inexperience. Consider that most AutoEditors don't
> vote much, don't dig much into history and don't actually spend much
> time doing all the complex tidying, dupe and merge searches etc; so
> there really is a very limited set of people that are likely to have
> stumbled across such bad editing.
>
> For the same personal reasons that votes on elections are (and should
> be) private, you're not going to get specifics on the people involved,
> but suffice to say, it's happening.
>

Well, this is a problem that is finally stated. Although the proposal
here may help this some, I don't think this will relieve this problem.
I would suggest a better way to help alleviate this issue is to put a
set of guidelines on the *nominator*. I don't know what those might be
specifically, but if someone could come up with a specific set of
guidelines that the nominator would have to demonstrate before bringing
the nomination forward, would that help? I think that might be more
helpful than just changing the voting percentage.
> In any case, if people don't think there will be much effect, why don't
> we just try it? Saying you don't think it will change anything isn't an
> argument against doing it, as far as I'm concerned (since there are many
> on the other side who think it will help) - you need an argument that
> explains why it will be /harmful/.
>
I never said I was opposed nor did I suggest it would be harmful, just
that it might not do all that much good.

Jeff

_______________________________________________
MusicBrainz-automods mailing list
MusicBrainz-automods@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-automods

From forum: MusicBrainz - Automods

[mb-bugs] [MusicBrainz Bug Tracker] #3985: Unreadible tags in M4A

2008-10-15T15:41:02Z

#3985: Unreadible tags in M4A
---------------------------+------------------------------------------------
Reporter: Guhndahb | Owner:
Type: bug | Status: new
Priority: normal | Milestone:
Component: Picard Tagger | Version: Picard 0.10.0
Keywords: | Browser: Netscape, Firefox, Mozilla (Gecko)
Os: Windows XP |
---------------------------+------------------------------------------------
All M4A tags, other than embedded cover art, do not show up in foobar2000
or MP3Tag when tagged with Picard. Embedded cover art works fine.

Steps to reproduce:[[BR]]
1) Encode an audio file to M4A/MP4 with NeroAAC w/ no tags[[BR]]
2) Tag file w/ Picard (with or without embedded cover art)[[BR]]
3) Read the tags in foobar2000 or MP3Tag, they will be missing[[BR]]

Notes:[[BR]]
- If I edit the tags in foobar2000 first, then tag it with Picard, then
all the tags will show up in foobar2000 and MP3Tag.[[BR]]
- WinAmp seems to be able to read the tags.[[BR]]
- If I tag the file with neroAacTag.exe first, those tags show up fine in
both foobar2000 and MP3Tag. If I then run it through Picard, the Picard
tags do not show up but the originals do even though "Clear existing
tags..." is enabled in Picard. Loading it again in Picard will show the
Picard tags and not the original tags.[[BR]]

Versions used:[[BR]]
foobar2000: 0.9.5.6[[BR]]
Picard: 0.10[[BR]]
NeroAAC: 1.3.3.0[[BR]]
MP3Tag: 2.41[[BR]]

Picard plugins installed (also occurs with none installed):[[BR]]
bonusdisc[[BR]]
discnumber[[BR]]
ui_options_lastfm[[BR]]
coverart

--
Ticket URL: <http://bugs.musicbrainz.org/ticket/3985>
MusicBrainz Bug Tracker <http://musicbrainz.org>
MusicBrainz -- the music metadatabase
_______________________________________________
Musicbrainz-bugs mailing list
Musicbrainz-bugs@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-bugs

From forum: musicbrainz-bugs

Re: Should we change automod elections to require a two-thirds majority?

2008-10-15T15:40:06Z

* Gioele <gioeleb@...> [2008-16-10 01:21 EEST]:

> On Wed, Oct 15, 2008 at 11:39 PM, symphonick <symphonick@...> wrote:
> > Perhaps we could try setting some thresholds you have to pass before
> > you can be nominated? Say at least 1000 edits & 1000 votes? & possibly
> > a time limit too, active for at least 3 months or something?
> Maybe what we really need is new discussion about the Autoeditor
> status: what should be done to get it? What makes you worth of that
> status? Is there a way to become unsuitable for the autoeditor status?
> What should we do when you're not suitable anymore?
>
> And bit more in depth:
> Is the edits count important?
> Is the votes count important?
> How do we evaluate the quality of the edits and of the votes?
>
> Yes, maybe these questions are more important than what threshold should we set.

+1

_______________________________________________
MusicBrainz-automods mailing list
MusicBrainz-automods@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-automods

signature.asc (204 bytes) Download Attachment

From forum: MusicBrainz - Automods

Re: Should we change automod elections to require a two-thirds majority?

2008-10-15T15:25:51Z

2008/10/15, Gioele <gioeleb@...>:

> On Wed, Oct 15, 2008 at 11:39 PM, symphonick <symphonick@...> wrote:
>> Perhaps we could try setting some thresholds you have to pass before
>> you can be nominated? Say at least 1000 edits & 1000 votes? & possibly
>> a time limit too, active for at least 3 months or something?
> Maybe what we really need is new discussion about the Autoeditor
> status: what should be done to get it? What makes you worth of that
> status? Is there a way to become unsuitable for the autoeditor status?
> What should we do when you're not suitable anymore?
>
> And bit more in depth:
> Is the edits count important?
> Is the votes count important?
> How do we evaluate the quality of the edits and of the votes?
>
> Yes, maybe these questions are more important than what threshold should we
> set.
>
> Bye,
>
> --
> Gioele <gioeleb@...>
>

+1

--

/symphonick

_______________________________________________
MusicBrainz-automods mailing list
MusicBrainz-automods@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-automods

From forum: MusicBrainz - Automods

Re: Should we change automod elections to require a two-thirds majority?

2008-10-15T15:17:03Z

On Wed, Oct 15, 2008 at 11:39 PM, symphonick <symphonick@...> wrote:
> Perhaps we could try setting some thresholds you have to pass before
> you can be nominated? Say at least 1000 edits & 1000 votes? & possibly
> a time limit too, active for at least 3 months or something?
Maybe what we really need is new discussion about the Autoeditor
status: what should be done to get it? What makes you worth of that
status? Is there a way to become unsuitable for the autoeditor status?
What should we do when you're not suitable anymore?

And bit more in depth:
Is the edits count important?
Is the votes count important?
How do we evaluate the quality of the edits and of the votes?

Yes, maybe these questions are more important than what threshold should we set.

Bye,

--
Gioele <gioeleb@...>

_______________________________________________
MusicBrainz-automods mailing list
MusicBrainz-automods@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-automods

From forum: MusicBrainz - Automods

Re: MusicBrainz-users Digest, Vol 62, Issue 12

2008-10-15T15:13:32Z

> If you can convince anybody that this is true, then MusicBrainz should
> start hosting cover art directly without linking to other sites. Last
> I heard one issue is that MusicBrainz needs to be legal in more
> countries than just the US. Europe doesn't have a fair use doctrine,
> for example.
>
Europe, not being a signatory to the Berne convention, doesn't really
have any copyright laws anyway - though it does offer guidelines on
interpreting it. The member states do though, and they may have
equivalents to "Fair Use". In the UK (and some Commonwealth countries)
this is known as "Fair Dealing". The UKIPO site has some details:
http://www.ipo.gov.uk/copy/c-manage/c-useenforce/c-useenforce-use/c-useenforce-use-exception.htm

From a quick glance through (and not being a lawyer), MB might come in
under "non-commercial research", but probably not "criticism or review".

Apropos of the US rules and Wikipedia, it's perhaps worth noting that
they decided it wasn't fair use to upload any album cover just because
there was an entry about it, but there had to be critical commentary on
the album.

Acceptable use: *Cover art:* Cover art from various items, for
identification /only in the context of/ critical commentary /of that
item/ (not for identification /without/ critical commentary).

Unacceptable use: An album cover as part of a discography, as per the above.

From: http://en.wikipedia.org/wiki/Wikipedia:Non-free_content

- Si: chiark

_______________________________________________
MusicBrainz-users mailing list
MusicBrainz-users@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-users

From forum: Musicbrainz - Users

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T15:10:26Z

On 10/15/08, Lucas Gonze <lucas@...> wrote:
> Got a pointer to a bug report? Maybe we can escalate the issue.

I'm pretty sure I filed up a ticket but I searched through all my
email and can't find it. Either I thought I did and ended up not
doing it (hey, it can happen to anyone) or I deleted the record.
Either way, can't provide a link.

On 10/15/08, Sebastian Pipping <webmaster@...> wrote:
> Are we talking about reading or writing here? Both?

When I tested last year it was both, but supposedly it got fixed, so
I'll say it's only while writing. I'll see if I can test the latest
VLC on one of the computers in the office; half of them run Windows.

-Ivo

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

From forum: MusicBrainz - Playlist

Re: [mb-bugs] [MusicBrainz Bug Tracker] #3981: Add ratings support

2008-10-15T14:46:07Z

#3981: Add ratings support
-------------------------------------------------+--------------------------
Reporter: murdos | Owner:
Type: enhancement | Status: new
Priority: normal | Milestone:
Component: Picard Tagger | Version:
Resolution: | Keywords:
Browser: Netscape, Firefox, Mozilla (Gecko) | Os: Linux
-------------------------------------------------+--------------------------
Comment (by rob):

This approach is fine with me!

--
Ticket URL: <http://bugs.musicbrainz.org/ticket/3981#comment:5>
MusicBrainz Bug Tracker <http://musicbrainz.org>
MusicBrainz -- the music metadatabase
_______________________________________________
Musicbrainz-bugs mailing list
Musicbrainz-bugs@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-bugs

From forum: musicbrainz-bugs

Re: Should we change automod elections to require a two-thirds majority?

2008-10-15T14:39:56Z

2008/10/15, Chad Wilson <chad.wilson@...>:
> Increasing to 66% will make the threshold for objection a bit easier;
> and potentially encourage more critical investigation into new editors
> since the level of objection that has to be gained is lower, and more
> achievable.

It will also mean that a no-vote would be worth more than a yes, which
I personally find a bit problematic.
Perhaps we could try setting some thresholds you have to pass before
you can be nominated? Say at least 1000 edits & 1000 votes? & possibly
a time limit too, active for at least 3 months or something?

--

/symphonick

_______________________________________________
MusicBrainz-automods mailing list
MusicBrainz-automods@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-automods

From forum: MusicBrainz - Automods

Re: wiki migration?

2008-10-15T14:38:45Z

On Oct 12, 2008, at 11:57 PM, Lukáš Lalinský wrote:

> The script to migrate the wiki is more or less done, what's missing is
> a MB skin for MediaWiki and some mb_server work to port wiki
> documentation transclusion.

I'm willing to work on the WikiDocs portion of things. (ick PHP) But
not until after the next mb-server release -- I cannot afford to get
side-tracked by non-critical projects until after the next release.

Who wants to design the skin?

--

--ruaok Somewhere in Texas a village is *still* missing its idiot.

Robert Kaye -- rob@... -- http://mayhem-chaos.net

_______________________________________________
MusicBrainz-users mailing list
MusicBrainz-users@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-users

From forum: Musicbrainz - Users

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T13:42:33Z

Ivo Emanuel Gonçalves wrote:
>> Also I really hope this
>>
>> <location>C:\My%20Music\playlist.xspf</location>
>>
>> is not what VLC was/is producing.
>
> Yes. They still do not see this as a bug; it's a feature. Yes, really.

Are we talking about reading or writing here? Both?

Sebastian

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

From forum: MusicBrainz - Playlist

r10479 - mb_server/trunk/htdocs/show/edit

2008-10-15T13:39:49Z

Author: murdos
Date: 2008-10-15 20:39:51 +0000 (Wed, 15 Oct 2008)
New Revision: 10479

Modified:
mb_server/trunk/htdocs/show/edit/conditions.html
Log:
New attempt to make more explicit the fact that high quality edits won't fail if they don't have 4 edits.

Modified: mb_server/trunk/htdocs/show/edit/conditions.html
===================================================================
--- mb_server/trunk/htdocs/show/edit/conditions.html 2008-10-15 20:35:28 UTC (rev 10478)
+++ mb_server/trunk/htdocs/show/edit/conditions.html 2008-10-15 20:39:51 UTC (rev 10479)
@@ -69,12 +69,15 @@
$m->out('</table><br/>');

</%perl>
-<p style="margin-bottom: 1em;">
-For each edit type and each quality level the table below shows the voting
-period that an edit will remain open for, the number of unanimous votes required
-to shortcut the edit period, what happens if the edit expires but has no votes,
-and whether or not an edit is considered an <& /comp/linkdoc, "AutoEdit", "auto-edit" &> for an <&/comp/linkdoc, "AutoEditor", "auto-editor" &>.
+<p>
+For each edit type and each quality level the table below shows:
</p>
+<ul>
+ <li> the voting period that an edit will remain open for, </li>
+ <li> the number of unanimous votes required to shortcut the edit period, </li>
+ <li> what happens if the edit expires but has no votes, </li>
+ <li> and whether or not an edit is considered an <& /comp/linkdoc, "AutoEdit", "auto-edit" &> for an <&/comp/linkdoc, "AutoEditor", "auto-editor" &>.
+</ul>

<%perl>

@@ -176,7 +179,7 @@

<p>
<span id="note-1" class="superscript">1</span> Voting period in days<br />
- <span id="note-2" class="superscript">2</span> Unanimous votes<br />
+ <span id="note-2" class="superscript">2</span> Unanimous votes required to shortcut the edit period<br />
<span id="note-3" class="superscript">3</span> Expire action when edit has no votes (abstain votes excluded)<br />
<span id="note-4" class="superscript">3</span> <& /comp/linkdoc, "AutoEdit", "auto-edit" &> for all users
</p>

_______________________________________________
MusicBrainz-commits mailing list
MusicBrainz-commits@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-commits

From forum: musicbrainz-commits

r10478 - mb_server/trunk/htdocs/user/tags

2008-10-15T13:35:28Z

Author: murdos
Date: 2008-10-15 20:35:28 +0000 (Wed, 15 Oct 2008)
New Revision: 10478

Modified:
mb_server/trunk/htdocs/user/tags/index.html
mb_server/trunk/htdocs/user/tags/tag.html
Log:
Respect editor privacy for tags

Modified: mb_server/trunk/htdocs/user/tags/index.html
===================================================================
--- mb_server/trunk/htdocs/user/tags/index.html 2008-10-15 20:23:35 UTC (rev 10477)
+++ mb_server/trunk/htdocs/user/tags/index.html 2008-10-15 20:35:28 UTC (rev 10478)
@@ -18,18 +18,32 @@
or return $m->comp("/comp/error", "There is no user with id #$userid", 1, 1);
}

- my $t = MusicBrainz::Server::Tag->new($mb->{DBH});
- my $tags = $t->GetRawTagHash($userid);
+ my $private = $is_me ? 0 : not UserPreference::get_for_user("tags_public", $user);
+
+ my ($t, $tags);
+ unless ($private)
+ {
+ $t = MusicBrainz::Server::Tag->new($mb->{DBH});
+ $tags = $t->GetRawTagHash($userid);
+ }
</%perl>

<& /comp/sidebar, pagetitle => ($is_me ? "My" : $user->GetName . "'s") . " Tags" &>

+% if ($private)
+% {
+ <h3><% $user->GetName %>'s tags are private.</h3>
+% }
+% else
+% {
+
<div class="TagsBox">
<p style="margin-bottom: 1em;">
<% $t->GenerateTagCloud($tags, "all", 12, 30, undef, '/user/tags/tag.html?userid=' . $userid . '&') | n %>
</p>
</div>

+% }
<& /comp/footer &>

%# vi: set ts=4 sw=4 ft=mason :

Modified: mb_server/trunk/htdocs/user/tags/tag.html
===================================================================
--- mb_server/trunk/htdocs/user/tags/tag.html 2008-10-15 20:23:35 UTC (rev 10477)
+++ mb_server/trunk/htdocs/user/tags/tag.html 2008-10-15 20:35:28 UTC (rev 10478)
@@ -27,6 +27,8 @@
or return $m->comp("/comp/error", "There is no user with id #$userid", 1, 1);
}

+ my $private = $is_me ? 0 : not UserPreference::get_for_user("tags_public", $user);
+
my $t = MusicBrainz::Server::Tag->new($mb->{DBH});
my ($entities, $numitems);

@@ -77,6 +79,13 @@
<a href="/user/tags/tag.html?userid=<% $userid %>&tag=<% uri_escape($tag) %>∓show=track">tracks</a> ]
% }

+% if ($private)
+% {
+ <h3><% $user->GetName %>'s tags are private.</h3>
+% }
+% else
+% {
+
% my @types = ($show eq 'all') ? ("artist", "label", "release", "track") : ($show);
% my $limit = ($show eq 'all') ? 10 : 100;
% for my $type (@types) {
@@ -111,6 +120,7 @@
% }
% }
% }
+% }

<& /comp/footer &>

_______________________________________________
MusicBrainz-commits mailing list
MusicBrainz-commits@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-commits

From forum: musicbrainz-commits

Re: Cover art sites

2008-10-15T13:32:14Z

On Wed, Oct 15, 2008 at 10:08 PM, Alex Mauer <hawke@...> wrote:
> Philip Jägenstedt wrote:
>>
>> Example? Concerning archive.org, there's been discussion about what is
>> OK and not, see http://wiki.musicbrainz.org/CoverArtSitesDiscussion .
>> Last I heard it wasn't generally a good idea to link to sites other
>> than those listed, but I'm not sure what happens in practice right
>> now.
>
> Every single site on the CoverArtSites page which says "via archive.org".

I can't vouch for the others, but for those that I have added the
sites are either the copyright owner (Modern Sky) or a major fansite
(Lokpest and Cakeography). In the case of Lokpest the band itself has
actually given permission. I'm honestly not sure what the legal status
of Cakeography is, but I think it's fair to say that if the band
objected the site would already have been taken down. The same is
likely true of the other fansites.

What you want to do, on the other hand, seems little different from
linking to covers.cc or something like that.

With all that said, I'll also say that I'm not arguing against you
because I think it's a bad idea -- I think it would be the best thing
ever if all the covers in the world could be (legally) hosted in high
resolution by someone for MusicBrainz to use, but I don't think we
could get away with it. I don't even have any power to influence the
outcome of your "case", so perhaps I'll leave it to someone who has to
give a better answer.

Philip

> -Alex Mauer "hawke"
>
>
> _______________________________________________
> MusicBrainz-users mailing list
> MusicBrainz-users@...
> http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-users
>

_______________________________________________
MusicBrainz-users mailing list
MusicBrainz-users@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-users

From forum: Musicbrainz - Users

Re: First XSPF-related security issue? -- was: Re: [oss-security] CVE id request: vlc

2008-10-15T13:23:56Z

On Wednesday 15 October 2008, Lucas Gonze wrote:
> So the href correlates with track identifier? That's fascinating.
>
> As a point of security, then, this is an issue with a proprietary
> extension rather than with XSPF as a whole, and doesn't affect anyone
> who doesn't use that extension.

It does not matter whether XSPF or one extension is where the issue
manifests, as the *format* is not to be blamed for this security issue,
but VLC's parser implementation. So XSPF is not any more or less secure
just because some code failed.
On a side note, a format rarely is to be blamed for security issues (the
only recent exception that comes to my mind is the XML entity explosion
attack, aka "billion laughs").

Robert

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

signature.asc (852 bytes) Download Attachment

From forum: MusicBrainz - Playlist

r10477 - in mb_server/branches/Rating-BRANCH/htdocs: comp user/ratings

2008-10-15T13:23:36Z

Author: murdos
Date: 2008-10-15 20:23:35 +0000 (Wed, 15 Oct 2008)
New Revision: 10477

Modified:
mb_server/branches/Rating-BRANCH/htdocs/comp/ratingsbox
mb_server/branches/Rating-BRANCH/htdocs/user/ratings/index.html
Log:
Fix typo in previous commit and disallow rating entities while viewing ratings from a different editor.

Modified: mb_server/branches/Rating-BRANCH/htdocs/comp/ratingsbox
===================================================================
--- mb_server/branches/Rating-BRANCH/htdocs/comp/ratingsbox 2008-10-15 19:08:48 UTC (rev 10476)
+++ mb_server/branches/Rating-BRANCH/htdocs/comp/ratingsbox 2008-10-15 20:23:35 UTC (rev 10477)
@@ -6,10 +6,11 @@

$detailled => 0 # Display all ratings information (loaded from DB): aggregate rating, ratings count, user rating (will be loaded from DB)
$rating => undef # Allow passing a rating hash to avoid loading from DB
+
+ $allow_rating => 1
</%args>

<%perl>
-
# Check argument
MusicBrainz::Server::Validation::IsNonNegInteger($entity_id) && $entity_id
or return $m->comp("/comp/layout/badarguments", text => "Argument entity_id is required");
@@ -39,8 +40,10 @@

my $rate_url = "/bare/rate.html?entity_id=$entity_id&entity_type=$entity_type&url=". $r->uri()."?".$r->args() ."&rating=";
my %css_classes = ();
+
# Allow changing rate only if user is logged
- %css_classes = ( 1 => "one", 2 => "two", 3 => "three", 4 => "four", 5 => "five" ) if ($session{uid});
+ $allow_rating &&= defined $session{uid};
+ %css_classes = ( 1 => "one", 2 => "two", 3 => "three", 4 => "four", 5 => "five" ) if ($allow_rating);

</%perl>

Modified: mb_server/branches/Rating-BRANCH/htdocs/user/ratings/index.html
===================================================================
--- mb_server/branches/Rating-BRANCH/htdocs/user/ratings/index.html 2008-10-15 19:08:48 UTC (rev 10476)
+++ mb_server/branches/Rating-BRANCH/htdocs/user/ratings/index.html 2008-10-15 20:23:35 UTC (rev 10477)
@@ -26,7 +26,7 @@
or return $m->comp("/comp/error", "There is no user with id #$userid", 1, 1);
}

- my $private = $is_me ? 0 : (not UserPreference::get_for_user("rating_public", $user));
+ my $private = $is_me ? 0 : not UserPreference::get_for_user("ratings_public", $user);

my $rt = MusicBrainz::Server::Rating->new($mb->{DBH});

@@ -84,7 +84,9 @@
&></td>
<td><& /comp/ratingsbox, entity_id => $entity->{"id"}, entity_type => $type,
small => 1,
- rating => { rating => $entity->{"rating"} } &></td>
+ rating => { rating => $entity->{"rating"} },
+ allow_rating => $is_me,
+ &></td>
</tr>
% }
</table>

_______________________________________________
MusicBrainz-commits mailing list
MusicBrainz-commits@...
http://lists.musicbrainz.org/mailman/listinfo/musicbrainz-commits

From forum: musicbrainz-commits