Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

91–100 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#91

Post by immibis »

V__ wrote: post #80
theoldgreybeard wrote: post #72

The vulnerability in question is a Use After Free. Google used AI to find this bug, it would've taken them 3 seconds to fix it. Burning cash to generate spam bug reports to burden volunteer projects when you have the extra cash to burn to just fix the damn issue leaves a very sour taste in my mouth.

Notably, the vulnerability is also in a part which isn't included by default and nobody uses. I'm not sure that even warrants a CVE? A simple bug report would have probably been fine. If they think this is really a CVE, a bug fix commit would have been warranted.

AIUI there's no such thing as "really a CVE". A CVE is merely a standardized identifier for a bug so you can call it "CVE-2025-XXXXX" rather than "that use-after-free Google found in ffmpeg with AI." It doesn't imply anything else about the bug, except that it may impact security. The Linux kernel assigns one to every bugfix that may impact security (which is most kernel bugs) to avoid controversy about whether they should be assigned.

Re: FFmpeg to Google: Fund us or stop sending bugs

#94

Post by rescbr »

zxspectrum1982 wrote: post #75
phkahler wrote: post #54

From TFA this was telling: Thus, as Mark Atwood, an open source policy expert, pointed out on Twitter, he had to keep telling Amazon to not do things that would mess up FFmpeg because, he had to keep explaining to his bosses that “They are not a vendor, there is no NDA, we have no leverage, your VP has refused to help fund them, and they could kill three major product lines tomorrow with an email. So, stop, and liste…

Google is not paying anyone to find bugs. They are running AIs indiscriminately.

Still, they are paying for the computing resources needed to run the AI/agents etc.

Re: FFmpeg to Google: Fund us or stop sending bugs

#95

Post by adastra22 »

ikiris wrote: post #31
StopDisinfo910 wrote: post #14

Earlier quoted context omitted.

It’s not bug reports. It’s CVE. There is a convergence of very annoying trends happening: more and more are garbage found and written using AI and with an impact which is questionable at best, the way CVE are published and classified is idiotic and platform founding vulnerability research like Google are more and more hostile to projects leaving very little time to actually work on fixes before publishing. This is le…

The lowered lead times are because devs have an entitled additude that others fix their code when they discover bugs in it. The 90 day period is the grace period for the dev, not a demand. If they don't want to fix it then it goes public.

> The lowered lead times are because devs have an entitled additude that others fix their code when they discover bugs in it.

That’s how open source works.

Re: FFmpeg to Google: Fund us or stop sending bugs

#96

Post by bhouston »

I would suggest that FFmpeg spin up a commercial arm that gets support contracts with Google, Amazon, etc, but with a tight leash so that it does not undermine the open source project. Would need clean guidance as to what the commercial arm does and does not.

Probably could pull in millions per year.

Re: FFmpeg to Google: Fund us or stop sending bugs

#98

Post by adastra22 »

kykat wrote: post #56
ranger_danger wrote: post #22

Earlier quoted context omitted.

CVEs aren't caused by bugs?

You could argue that, but I think that a bug is the software failing to do what it was specified, or what it promised to do. If security wasn't promised, it's not a bug.

Which is exactly the case here. This CVE is for a hobby codec written to support digital preservation of a some obscure video files from the 90’s that are used nowhere else. No security was promised.

Re: FFmpeg to Google: Fund us or stop sending bugs

#99

Post by portaouflop »

zxspectrum1982 wrote: post #77
skrebbel wrote: post #73

Earlier quoted context omitted.

How could ffmpeg maintainers kill three major AWS product lines with an email?

Easy: ffmpeg discontinues or relicenses some ffmpeg functionality that AWS depends on for those product alines and AWS is screwed. I've seen that happen in other open source projects.

Wouldn’t that only affect new versions and current versions are still licensed under the old license ?

Re: FFmpeg to Google: Fund us or stop sending bugs

#100

Post by dieortin »

V__ wrote: post #80
theoldgreybeard wrote: post #72

The vulnerability in question is a Use After Free. Google used AI to find this bug, it would've taken them 3 seconds to fix it. Burning cash to generate spam bug reports to burden volunteer projects when you have the extra cash to burn to just fix the damn issue leaves a very sour taste in my mouth.

Notably, the vulnerability is also in a part which isn't included by default and nobody uses. I'm not sure that even warrants a CVE? A simple bug report would have probably been fine. If they think this is really a CVE, a bug fix commit would have been warranted.

It is included by default
Post reply on HN