[flagged]
If your project is amenable to it, it's possible to wrap ffmpeg in a gvisor (runsc) docker container and greatly reduce the risk.
Germany's Sovereign Tech Fund Now Supporting FFmpeg
11–20 of 55 posts
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#12[flagged]
Serious question, let's say you had a ton of money and wanted to get this done, is there physically enough available Rust talent (at market rates) in the world today to port ffmpeg to rust in any reasonable amount of time? My understanding is that it's one of the biggest open source projects in terms of LoC, development hours needed to both create and maintain, and number of former and active developers working on the project.
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#13[flagged]
You're not wrong. Media codecs are a good attack vector. However, it's not so simple. You need hand crafted SIMD to reach desired performance. That is a whole area of specialized theory and research. I think it should be done, but who is going to fund it?
Germany’s Sovereign Tech Fund?
;-)
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#14[flagged]
It will possibly kill lots of community contributions. Currently its easy to add missing features to things like filters.
Who is going to do that in rust? I'm yet to see a practicing rust programmer IRL.
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#15[flagged]
Serious question, let's say you had a ton of money and wanted to get this done, is there physically enough available Rust talent (at market rates) in the world today to port ffmpeg to rust in any reasonable amount of time? My understanding is that it's one of the biggest open source projects in terms of LoC, development hours needed to both create and maintain, and number of former and active developers working on th…
There definitely is. You don't need support for all the obscure formats that ffmpeg supports.
It would still cost a lot though.
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#16[flagged]
I feel like using Wuffs would make more sense.
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#17It's very good that ffmpeg gets support and the sovereign tech fund is a good idea but for me it again just highlights how perverted the incentives to support open source are.
Millions of dollars are extracted by using ffmpeg from a lot of corporations, yet the German taxpayer pays for maintenance.
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#18[flagged]
I am a huge Rust fan, and also a huge FFmpeg fan.
What exactly does a complete rewrite of FFmpeg achieve given the absolutely monstrous complexity involved?
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#19Earlier quoted context omitted.
Serious question, let's say you had a ton of money and wanted to get this done, is there physically enough available Rust talent (at market rates) in the world today to port ffmpeg to rust in any reasonable amount of time? My understanding is that it's one of the biggest open source projects in terms of LoC, development hours needed to both create and maintain, and number of former and active developers working on th…
There definitely is. You don't need support for all the obscure formats that ffmpeg supports. It would still cost a lot though.
[deleted]
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#20[flagged]
You're not wrong. Media codecs are a good attack vector. However, it's not so simple. You need hand crafted SIMD to reach desired performance. That is a whole area of specialized theory and research. I think it should be done, but who is going to fund it?
It would involve unsafe rust anyway, which does sequester but not eliminate the concern. I think it would be difficult to make a case that this effort is worthwhile.