Hi all, The latest version of FLAC has been releases. See: https://xiph.org/flac/index.html https://xiph.org/flac/changelog.html The source tarball and Windows binaries are available (with md5 and sha256 checksums) at: http://downloads.xiph.org/releases/flac/ The source tarball is also available at: https://sourceforge.net/projects/flac/files/flac-src/ and similarly the Windows binaries at: https://sourceforge.net/projects/flac/files/flac-win/ Please feel free to spread the word and please reply to this email to let us know where this is being announced. I have announced it here and on my personal G+ account. Cheers, Erik -- ---------------------------------------------------------------------- Erik de Castro Lopo http://www.mega-nerd.com/
Erik de Castro Lopo wrote:> The latest version of FLAC has been releases.The Xiph.org download directory and github.com/xiph/flac don't seem to have been updated automatically as I expected. I'm chasing that. I also notice that on sourceforge: https://sourceforge.net/projects/flac/files/flac-win/ there are still 1000+ downloads per week 1.2.1 windows binaries with know security holes. What do people think of the idea of disabling downloads of old, known buggy Windows binary downlaods? Erik -- ---------------------------------------------------------------------- Erik de Castro Lopo http://www.mega-nerd.com/
Security is quite important, but I believe that audio quality and lossless performance trump security for nearly all users of flac. In other words, unless the bugs affect the lossless quality of flac, then those old downloads should remain available. Of course, place a notice about the potential for security issues, but let the users make their own decisions. Personally, I find it important to have the option of decoding my archived flac files with the same version of the code that I used to compress them. Granted, I'm on Mac (Unix), but I assume that the same security holes are in 1.2.1 for Unix as for Windows. Sorry I'm not much of an expert on the security issues, but it seems that lots of software has these sorts of security holes. We should certainly address the issues, but there's no need to force everyone to lose access to historical versions of the flac program. Even if the new versions of flac are perfectly compatible, there is still some benefit to having old versions that will run on old computer operating systems. I maintain a great number of old computers for audio recording purposes, and while they work fine for audio purposes they won't run new builds of certain software. Brian Willoughby On Dec 31, 2016, at 6:46 PM, Erik de Castro Lopo <mle+la at mega-nerd.com> wrote:> there are still 1000+ downloads per week 1.2.1 windows binaries > with know security holes. What do people think of the idea of > disabling downloads of old, known buggy Windows binary downlaods? >
Erik de Castro Lopo wrote:> I also notice that on sourceforge: > > https://sourceforge.net/projects/flac/files/flac-win/ > > there are still 1000+ downloads per week 1.2.1 windows binaries > with know security holes. What do people think of the idea of > disabling downloads of old, known buggy Windows binary downlaods?FLAC 1.2.1 is the last version that works on Win95/98/NT4/2000 and also it still has in_flac.dll (a plugin for Winamp 2.x). Also 1.2.1 is the latest official binaries that don't require SSE2. So it can be useful for some (very small) group of people.
On Jan 01 13:46:20, mle+la at mega-nerd.com wrote:> I also notice that on sourceforge: > https://sourceforge.net/projects/flac/files/flac-win/ > there are still 1000+ downloads per week 1.2.1 windows binaries > with know security holes.Does that mean the windows binaries, specifically, do contain the bug, but 1.2.1 as such does not?> What do people think of the idea of > disabling downloads of old, known buggy Windows binary downlaods?Removing old releases is pointless. What's there to gain by doing that? On Dec 31 19:04:08, brianw at audiobanshee.com wrote:> To put this another way, why not leave the 1.2.1 binaries available on > a secondary web page dedicated to legacy operating systems?Please don't. Why complicate things by maintaining another webpage, and for what? On Jan 01 10:54:21, lvqcl.mail at gmail.com wrote:> FLAC 1.2.1 is the last version that works on Win95/98/NT4/2000Running a buggy FLAC 1.2.1 is imho the least security problem for people running Win 95.
On Sun, Jan 01, 2017 at 01:23:20PM +1100, mle+la at mega-nerd.com wrote:> Please feel free to spread the word and please reply to this > email to let us know where this is being announced.Announcement was made on Facebook: https://www.facebook.com/flac.audio/posts/10154824982999519 -- -Dec. --- "Mosaic is going to be on every computer in the world." - Marc Andreessen, 1994
On Sun, Jan 01, 2017 at 01:46:20PM +1100, mle+la at mega-nerd.com wrote:> > The Xiph.org download directory and github.com/xiph/flac don't seem to have > been updated automatically as I expected. I'm chasing that.I should have checked that the new downloads were available from the official site, before announcing. 20 minutes after making the announcement, someone was asking how to use the new release with the EAC frontend. I'm going to reply saying to just drop in the new flac.exe. -- -Dec. --- "Mosaic is going to be on every computer in the world." - Marc Andreessen, 1994
On Sun, Jan 01, 2017 at 01:46:20PM +1100, mle+la at mega-nerd.com wrote:> > The Xiph.org download directory and github.com/xiph/flac don't seem to have > been updated automatically as I expected. I'm chasing that.The download host is hosted by Oregon State University - is it a mirror site that's just for Xiph projects? -- -Dec. --- "Mosaic is going to be on every computer in the world." - Marc Andreessen, 1994
Something seems to be wrong with cpu.c CPU detection code. When I compile things with MSVC all instructions except FMA is detected as missing, even though they are present in my CPU. That of course results in awful performance.
Attached is a patch to fix the incorrect CPU feature detection: On 2.1.2017 16.39, Janne Hyvärinen wrote:> Something seems to be wrong with cpu.c CPU detection code. When I > compile things with MSVC all instructions except FMA is detected as > missing, even though they are present in my CPU. That of course > results in awful performance. > > > _______________________________________________ > flac-dev mailing list > flac-dev at xiph.org > http://lists.xiph.org/mailman/listinfo/flac-dev-------------- next part -------------- diff --git a/src/libFLAC/cpu.c b/src/libFLAC/cpu.c index b9df19a..808d55d 100644 --- a/src/libFLAC/cpu.c +++ b/src/libFLAC/cpu.c @@ -269,9 +269,9 @@ void FLAC__cpu_info_x86(FLAC__uint32 level, FLAC__uint32 *eax, FLAC__uint32 *ebx __cpuid(cpuinfo, ext); if((unsigned)cpuinfo[0] >= level) { #if FLAC__AVX_SUPPORTED - __cpuidex(cpuinfo, ext, 0); /* for AVX2 detection */ + __cpuidex(cpuinfo, level, 0); /* for AVX2 detection */ #else - __cpuid(cpuinfo, ext); /* some old compilers don't support __cpuidex */ + __cpuid(cpuinfo, level); /* some old compilers don't support __cpuidex */ #endif *eax = cpuinfo[0]; *ebx = cpuinfo[1]; *ecx = cpuinfo[2]; *edx = cpuinfo[3];
Janne Hyvärinen wrote:> Something seems to be wrong with cpu.c CPU detection code. When I > compile things with MSVC all instructions except FMA is detected as > missing, even though they are present in my CPU. That of course results > in awful performance.What Windows version and CPU was this? Erik -- ---------------------------------------------------------------------- Erik de Castro Lopo http://www.mega-nerd.com/
On Sun, Jan 01, 2017 at 01:23:20PM +1100, mle+la at mega-nerd.com wrote:> > The latest version of FLAC has been releases. See: > > https://xiph.org/flac/index.htmlThe official website doesn't link to the SourceForge project, which seems to be the only place that's hosting the 1.3.2 files. As long as the xiph.org download site is still out of date, the official website shouldn't be pointing to it.> The source tarball is also available at: > https://sourceforge.net/projects/flac/files/flac-src/ > > and similarly the Windows binaries at: > https://sourceforge.net/projects/flac/files/flac-win/-- -Dec. --- "Mosaic is going to be on every computer in the world." - Marc Andreessen, 1994
Declan Kelly wrote:> > The official website doesn't link to the SourceForge project, which > seems to be the only place that's hosting the 1.3.2 files.There was an issue with the osul.org mirrors but it should be fixed now. Please let me know if any download.xiph.org/flac/ site is missing the 1.3.2 files. Erik -- ---------------------------------------------------------------------- Erik de Castro Lopo http://www.mega-nerd.com/