Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twenty One Zero-Days in FFmpeg

depthfirst.com

Post reply on HN
Print view View original

61–70 of 216 posts

Re: Twenty One Zero-Days in FFmpeg

#61

Post by bawolff »

naturalmovement wrote: post #37
bawolff wrote: post #35

Earlier quoted context omitted.

> nearly inexhaustible supply of LLM slop daily, Actual well written vulnerability reports are not the same as slop. AI slop is a real problem and annoying. Just because it exists does not mean every vulnerability report is AI slop. Ffmpeg devs are free not to care, but then they cant complain when they start to get a bad reputation.

> AI slop is a real problem and annoying. Just because it exists does not mean every vulnerability report is AI slop. Ok but who is going to sift through it all to triage the good bits when you're working on something for free? > Ffmpeg devs are free not to care, but then they cant complain when they start to get a bad reputation Who gives a shit about reputation when you're the only game in town? There is nothing ou…

> Ok but who is going to sift through it all to triage the good bits when you're working on something for free?

Its like anything else in open source. Maintainers will do so if they care. Maybe they decide they don't care. That is always their decision to make but there are consequences for the project. Maybe those consequences make sense. Being a maintainer is all about making cost-benefit trade offs.

> Who gives a shit about reputation when you're the only game in town?

Its up to the maintainers whether they care or not. It depends on what they value.

Ultimately if maintainers make decisions that are at odds with what their userbase want, someone eventually forks and people vote with their feet.

Re: Twenty One Zero-Days in FFmpeg

#62

Post by naturalmovement »

bawolff wrote: post #61
naturalmovement wrote: post #37

Earlier quoted context omitted.

> AI slop is a real problem and annoying. Just because it exists does not mean every vulnerability report is AI slop. Ok but who is going to sift through it all to triage the good bits when you're working on something for free? > Ffmpeg devs are free not to care, but then they cant complain when they start to get a bad reputation Who gives a shit about reputation when you're the only game in town? There is nothing ou…

> Ok but who is going to sift through it all to triage the good bits when you're working on something for free? Its like anything else in open source. Maintainers will do so if they care. Maybe they decide they don't care. That is always their decision to make but there are consequences for the project. Maybe those consequences make sense. Being a maintainer is all about making cost-benefit trade offs. > Who gives a…

Security is a bit different.

Today it's an industry driven by unscrupulous clout-chasers and a commitment to quantity over quality.

There is a difference between going through patches and pull requests vs. the endless stream of LLM-assisted bullshit that has started cluttering security inboxes in the last few years.

Re: Twenty One Zero-Days in FFmpeg

#63

Post by KPGv2 »

insanitybit wrote: post #38
loeg wrote: post #23

Earlier quoted context omitted.

They're also extremely hostile to security researchers who report these issues.

https://x.com/ffmpeg/status/2039115531744334180?s=46&t=qCSkw... Security is the punch line for ffmpeg.

Apr Fools Day really is the shittiest day to be online. For one thing, practical jokes/pranks are just gussied-up asshole behavior. For another thing, nerds generally SUCK at information-delivery pranks, which is what the Internet is full of on Apr 1.

Re: Twenty One Zero-Days in FFmpeg

#64

Post by KPGv2 »

grahamjperrin wrote: post #43
insanitybit wrote: post #38

Earlier quoted context omitted.

https://x.com/ffmpeg/status/2039115531744334180?s=46&t=qCSkw... Security is the punch line for ffmpeg.

I'm glad to see their sense of humour :-) https://nitter.net/ffmpeg/status/2039115531744334180

> Assembly is a human readable version of machine code. It's exactly the same.

goddamn, and this is a project that prides itself on having had-written assembly in it

Re: Twenty One Zero-Days in FFmpeg

#65

Post by jungfty »

da_chicken wrote: post #44
nerdsniper wrote: post #34

Earlier quoted context omitted.

It seems to have lost its meaning after getting popularized following Stuxnet coverage.

No, I think it was since Code Red. I understand why it's poorly understood. It's a snappy term, and people assume it means "bad" and nothing else because that's all you can get from the context. However, since most people also don't know the difference between a vulnerability and an exploit, they won't understand the definition of a zero-day when they read it. But I'm still going to complain if a security vulnerabili…

[dead]

Re: Twenty One Zero-Days in FFmpeg

#66

Post by hackernudes »

WD-42 wrote: post #53
nerdsniper wrote: post #33

Earlier quoted context omitted.

Is GStreamer a more secure alternative or does it just get a bit less attention than ffmpeg?

From what I understand gstreamer is more about building complex pipelines and plugins, ffmpeg is better at playing some obscure 20 year old video format extremely efficiently so you can watch it compiled for a potato. Different cases really I think both are good.

That's not really true. Ffmpeg is a Swiss army knife for anything related to digital multimedia (old and new). It is broken into a few libraries but doesn't really have plugins.

Gstreamer has a different model, chaining together plugins. Lots of overlap, but I think Gstreamer only has real traction because some silicon vendors use it.

Re: Twenty One Zero-Days in FFmpeg

#68

Post by oinoom »

zerobees wrote: post #19

Ffmpeg has an exceptionally terrible track record when it comes to security. People have been throwing fuzzers at it for as long as I remember and coming back with a nearly inexhaustible supply of memory corruption bugs. Here's an effort by one Googler a decade ago: https://security.googleblog.com/2014/01/ffmpeg-and-thousand-... So, while it's a demo of the capabilities of LLMs, this should not be at all surprising.…

Funny, John Carmack was just admiring the creator of ffmpeg the other day for being a better programmer. https://x.com/id_aa_carmack/status/2064095424420487226?s=46

Re: Twenty One Zero-Days in FFmpeg

#69

Post by wmf »

nerdsniper wrote: post #33
zerobees wrote: post #19

Ffmpeg has an exceptionally terrible track record when it comes to security. People have been throwing fuzzers at it for as long as I remember and coming back with a nearly inexhaustible supply of memory corruption bugs. Here's an effort by one Googler a decade ago: https://security.googleblog.com/2014/01/ffmpeg-and-thousand-... So, while it's a demo of the capabilities of LLMs, this should not be at all surprising.…

Is GStreamer a more secure alternative or does it just get a bit less attention than ffmpeg?

Doesn't GStreamer mostly use ffmpeg plugins?

Re: Twenty One Zero-Days in FFmpeg

#70

Post by tptacek »

oinoom wrote: post #68
zerobees wrote: post #19

Ffmpeg has an exceptionally terrible track record when it comes to security. People have been throwing fuzzers at it for as long as I remember and coming back with a nearly inexhaustible supply of memory corruption bugs. Here's an effort by one Googler a decade ago: https://security.googleblog.com/2014/01/ffmpeg-and-thousand-... So, while it's a demo of the capabilities of LLMs, this should not be at all surprising.…

Funny, John Carmack was just admiring the creator of ffmpeg the other day for being a better programmer. https://x.com/id_aa_carmack/status/2064095424420487226?s=46

One thing has nothing to do with the other.
Post reply on HN