121–130 of 202 posts
The creator of ffmpeg, Fabrice Bellard, has an impressively long list of projects. Very talented developer! https://bellard.org/
Some speculate that Fabrice Bellard is actually as many as ten different people.
Earlier quoted context omitted.
> don't write the first function before you know what will be the last This is some seriously deep meta-heuristics. Very insightful. Thank you.
Do we need a "Think before code" manifesto? This is a true counter-standpoint to all the agile cargo cult that has been developed in the last years... Not to be taken as 100% dogma, like everything...
Earlier quoted context omitted.
It's a programming language issue. Any time you're writing complex format parsing code in an unsafe language like C, you're going to run into these problems. Unfortunately, Rust didn't exist when ffmpeg was created. Patents have absolutely nothing to do with this; they don't affect the security of the resulting code. Nobody can write code for all the formats ffmpeg supports and do it safely, in C. Nobody. You think a…
> It's just not humanly possible to get this right in every instance. That's what theorem provers and model driven development are for. I wish these tools could be used more. There should also be automated completeness checkers for requirements and specs - a lot of errors, incompatibilities and security issues are the result of ambiguous, contradictory, or incomplete specs and requirements.
That's building a safe programming language on top of an unsafe one. At that point you might as well just use a safe programming language.
That won't fix logic errors, but the vast majority of security issues are safety problems, especially in this kind of codebase.
>FFMPEG is a media processing framework. It's great for simple media processing jobs (builds a graph, runs the graph). A build of "FFMPEG" includes that media processing framework plus dozens of open source libraries (filters) that do the actual work (x265, x265, libav, etc).
>So "FFMPEG" gets a lot of well deserved credit (it's the framework that lots of applications and well-known services run), but the core FFMPEG is probably a tiny fraction of the development man-hours in a build of FFMPEG. It's all the linked libraries that make it useful.
It is also worth stating this is from 2020. I am not sure why this is submitted now.
Earlier quoted context omitted.
This is a code audit issue. Video codecs and drivers are a niche and are extremely protected by patents. The number of ffmpeg researchers and developers is very small compared to the number of lines of code, closed standards and soft/hard bugs in each series of specific video hw/sw encoders and decoders. And an AI that can analyze and validate code as complex as ffmpeg has yet to be invented.
It's a programming language issue. Any time you're writing complex format parsing code in an unsafe language like C, you're going to run into these problems. Unfortunately, Rust didn't exist when ffmpeg was created. Patents have absolutely nothing to do with this; they don't affect the security of the resulting code. Nobody can write code for all the formats ffmpeg supports and do it safely, in C. Nobody. You think a…
Earlier quoted context omitted.
It's a programming language issue. Any time you're writing complex format parsing code in an unsafe language like C, you're going to run into these problems. Unfortunately, Rust didn't exist when ffmpeg was created. Patents have absolutely nothing to do with this; they don't affect the security of the resulting code. Nobody can write code for all the formats ffmpeg supports and do it safely, in C. Nobody. You think a…
> It's just not humanly possible to get this right in every instance. That's what theorem provers and model driven development are for. I wish these tools could be used more. There should also be automated completeness checkers for requirements and specs - a lot of errors, incompatibilities and security issues are the result of ambiguous, contradictory, or incomplete specs and requirements.
I think it is worth posting Tom Vaughan [1]( Father of x265 )'s reply here. >FFMPEG is a media processing framework. It's great for simple media processing jobs (builds a graph, runs the graph). A build of "FFMPEG" includes that media processing framework plus dozens of open source libraries (filters) that do the actual work (x265, x265, libav, etc). >So "FFMPEG" gets a lot of well deserved credit (it's the framework…
The creator of ffmpeg, Fabrice Bellard, has an impressively long list of projects. Very talented developer! https://bellard.org/
Don't forget about gstreamer. Both FFMPEG and gstreamer are used in many production environments. That said, you also find professional codecs and transport libraries. I've worked on projects using Main Concept codecs and custom plumbing, for instance.
Genuine question: Are there any actual examples of giant companies using gstreamer? Why I ask is that pretty much the only reason I have gstreamer installed on my pesonal laptop is to satisfy certain GNOME dependencies (due to GNOME, understandably, dogfooding its own stuff). Everything else (including apps I use daily e.g. mpv, Firefox, etc) depends on ffmpeg. $ sudo pacman -Rs gstreamer checking dependencies... err…