I know that in general the Drupal project doesn't include 3rd party code in our repository, but as part of a GHOP task to analyze security there was the proposal of adding the needed id3 libraries to the audio module in CVS so that people can now "just download audio" and be safe instead of "download audio, get the id3 module, install id3, delete all these other unsafe files". Having so many steps is a pain and is likely to be forgotten.

This is still an information gathering stage and is not a consensus or accepted idea of the security team at this point- I'm just curious what you, the maintainers, feel about this and whether you want to take the responsibility of mirroring those files as they get updated.

For the sake of this discussion, ignore the fact that Drupal project generally doesn't allow 3rd party code to be committed to the cvs repository.

Comments

zirafa’s picture

zirafa commented

I +1 the idea of removing steps to getting this module up and running faster.

The only issue with including id3 by default is: a) increases file size of download b) requires more maintenance to follow id3 development and c) not exactly *required* for every use case of the module. A packaging script that could bundle things on the fly could be cool too.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

Does audio module need all the files in the getid3 subfolder of the getid3 zip file or just the "getid3.php and write.php" that are mentioned in the INSTALL.txt

If it needs all the files - 227KB. If it just needs the two - 16KB. Audio module itself is 194KB. Those numbers are based on a tarred file created using "tar czf" which I believe is at least similar to what the packaging script uses.

So, it would either more than double the size of the module or add less than 10%. Either way, it's still a pretty small number in total.

The b "more maintenance" is I think the most valid concern since we want to make your lives easier in addition to making users safer.

Code that's not required...no real loss there, right? Or is there a performance problem with having it. If people don't want it they can always just delete it.