Is using mysql as insecure as it looks?
#1
I hope I am miss understanding something, but as far as I can tell you basically have to give xbmc complete access to your mysql server. From reading the installation instructions, it looks like it creates a new numbered database, maybe for every version or something? So their suggestion is to grant permissions for *everything*. Then the password is stored in clear text in an xml file.

You can limit the damage by restricting the grants after, but after every upgrade you have to fix it.

Why doesn't xbmc just use a single database and perhaps use prefixes on table names or something?
Reply
#2
when there are changes to database structure in XBMC updates, it updates the database as well (creates a new 'versioned' one) that way you can keep your previous install working in case you want to roll back, or just test the new one.

what i do, is only give the xbmc mysql user privileges to xbmc_* databases, then in advancedsettings.xml, make your database xbmc_video and xbmc_music.
Reply
#3
Ah, with the <name></name> attribute? That makes sense. Thanks!
Reply
#4
Yes but <name></name> has a reputation for not working!
If I have helped you or increased your knowledge, click the 'thumbs up' button to give thanks :) (People with less than 20 posts won't see the "thumbs up" button.)
Reply
#5
Most people who set up MySQL for XBMC are only using MySQL for XBMC. Doesn't matter much, since eventually MySQL will be replaced by something else for library sharing/syncing.
Reply
#6
If you run other stuff on the MySQL server and want to seperate access it can be done quite easily.

You can restrict the user XBMC uses to only have access to the databases you created when setting up, or even use seperate instances of MySQL.

Just remember to grant full permissions when you upgrade to Gotham in a few months
Reply
#7
(2013-05-04, 15:54)Ned Scott Wrote: Doesn't matter much, since eventually MySQL will be replaced by something else for library sharing/syncing.

could you give more information on this? MySQL is great in the way you can add things to the library without interact with xbmc, and taking away that possibility is at least for me a step back.
Reply
#8
(2013-05-04, 15:54)Ned Scott Wrote: Most people who set up MySQL for XBMC are only using MySQL for XBMC. Doesn't matter much, since eventually MySQL will be replaced by something else for library sharing/syncing.
Ned, that is an interesting tidbit...

Any ideas on what it would be changing to?
Reply
#9
I could be wrong here, so feel free to correct me anyone, but i believe the idea is to replace the use of mysql for syncing multiple xbmc machines with upnp. each xbmc instance would share out its library if it was configured too by enabling that option in the settings, and they would all just kind of see each other, and be able to play each others content. This functionality is currently avaliable in frodo, but from what i have gathered, they want to streamline it to make it more effortless, and there are certain things it cannot currently do, like mark remote content as watched.
Reply
#10
UPnP is one approach, but there are additional ideas that also use JSON-RPC to have XBMC devices simply talk to each other, and actually "sync" individual databases. There's no sure set plan at this moment, but the devs know of a bunch of methods that could be explored that should be easier to set up and maintain than MySQL, and even offer more features and flexibility.

One thing is for sure, and that is that we won't remove MySQL support from XBMC until a suitable replacement has been found and implemented.
Reply
#11
For the interested: You will notice that the Google Summer of Code 2013 (wiki) wiki page lists several ideas that tie in to this.
It is very possible one of the GSoC students will work on a component related to this idea.

Obviously there are many components that would need to be modified or rewritten to make replacing MySQL feasible, so don't expect this to be finished soon - this is a long term project.
Reply
#12
(2013-05-06, 09:01)Kibje Wrote: For the interested: You will notice that the Google Summer of Code 2013 (wiki) wiki page lists several ideas that tie in to this.
It is very possible one of the GSoC students will work on a component related to this idea.

Obviously there are many components that would need to be modified or rewritten to make replacing MySQL feasible, so don't expect this to be finished soon - this is a long term project.
IMHO a solution in search of a problem, but that's just me Smile
If I have helped you or increased your knowledge, click the 'thumbs up' button to give thanks :) (People with less than 20 posts won't see the "thumbs up" button.)
Reply
#13
MySQL is already full of existing problems. No need to search for them.
Reply

Logout Mark Read Team Forum Stats Members Help
Is using mysql as insecure as it looks?0