FFmpeg to Google: Fund us or stop sending bugs
thenewstack.io
FFmpeg to Google: Fund us or stop sending bugs
1–10 of 913 posts
Re: FFmpeg to Google: Fund us or stop sending bugs
#2I get the idea of publicly disclosing security issues to large well funded companies that need to be incentivized to fix them. But I think open source has a good argument that in terms of risk reward tradeoff, publicly disclosing these for small resource constrained open source project probably creates a lot more risk than reward.
Re: FFmpeg to Google: Fund us or stop sending bugs
#3Wouldn't they just fork it, fix their own bugs and stop contributing at all?
Re: FFmpeg to Google: Fund us or stop sending bugs
#4They obviously need to be reminded that the only reason Google has to care about FLOSS projects is when they can effectively use them to create an advertising panopticon under the company's complete control.
Re: FFmpeg to Google: Fund us or stop sending bugs
#5Wouldn't they just fork it, fix their own bugs and stop contributing at all?
Google internally maintaining a fork that attempts to track upstream has a ongoing cost that increases over time
vs. spamming OSS maintainers with slop reports costs Google nothing
Re: FFmpeg to Google: Fund us or stop sending bugs
#6Not too fond of maintainers getting too uppity about this stuff. I get that it can be frustrating to receive bug report after bug report from people who are unwilling or unable to contribute to the code base, or at the very least to donate to the team.
But the way I see it, a bug report is a bug report, no matter how small or big the bug or the team, it should be addressed.
I don’t know, I’m not exactly a pillar of the FOSS community with weight behind my words.
Re: FFmpeg to Google: Fund us or stop sending bugs
#7I am fairly confident that this article is largely AI-generated. More generally, the whole site appears to be heavy on AI slop, e.g.: https://thenewstack.io/how-ai-is-pushing-kubernetes-storage-...
And maybe it's fine to have AI-generated articles that summarize Twitter threads for HN, but this is not a good summarization of the discussion that unfolded in the wake of this complaint. For one, it doesn't mention a reply from Google security, which you would think should be pretty relevant here.
Re: FFmpeg to Google: Fund us or stop sending bugs
#8A bunch of people who make era-defining software for free. A labor of love.
Another bunch of people who make era-defining software where they extract everything they can. From customers, transactionally. From the first bunch, pure extraction (slavery, anyone?).
Re: FFmpeg to Google: Fund us or stop sending bugs
#9Google might be aiming to replace ffmpeg as the world's best media professor. Remember how Jia Tan (under different names) flooded xz with work before stepping up as a maintainer.
Re: FFmpeg to Google: Fund us or stop sending bugs
#10I’m an open source maintainer, so I empathize with the sentiment that large companies appear to produce labor for unpaid maintainers by disclosing security issues. But appearance is operative: a security issue is something that I (as the maintainer) would need to fix regardless of who reports it, or would otherwise need to accept the reputational hit that comes with not triaging security reports. That’s sometimes perfectly fine (it’s okay for projects to decide that security isn’t a priority!), but you can’t have it both ways.