Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg dealing with a security researcher

twitter.com

Post reply on HN
Print view View original

11–20 of 174 posts

Re: FFmpeg dealing with a security researcher

#11

Post by lukeschlather »

TheChaplain wrote: post #3

The comments from the public.. Just wow we are doomed.. To explain, Googles vulnerability scanner found a problem in an obscure decoder for a 1990s game files (Lucasfilm Smush). Devs are not happy they get timewasting reports on stuff that rarely anyone ever uses except an exceptionally tiny group. Then people start berating them without even knowing the full story...

Google operates a transcoder API which I suspect is just ffmpeg under the hood, and if you assume that they accept any input file, they really can't afford for decoders to have security vulnerabilities. Of course, then Google should be coming with more resources and not just filing bugs because it's Google that has the unusual use case.

Re: FFmpeg dealing with a security researcher

#12

Post by fabrice_d »

GaryBluto wrote: post #8

Rather unprofessional for an official project twitter account to complain about "slop" > We take security very seriously but at the same time is it really fair that trillion dollar corporations run AI to find security issues on people's hobby code? Then expect volunteers to fix. Yes. If a vulnerability exists, it's wise to report it. You don't need to fix it immediately (nobody has got a gun to your head) but just be…

It is absolutely Google's security issue if they use an open source project with that license:

https://git.ffmpeg.org/gitweb/ffmpeg.git/blob/HEAD:/COPYING....

and then expect volunteers to provide them fixes.

Re: FFmpeg dealing with a security researcher

#13

Post by ls612 »

vqtska wrote: post #7

I wonder if this vulnerable codec is enabled by default when building FFmpeg? Because if so, then it doesn't matter that it's a "1990s game codec" because any application using FFmpeg to accept arbitrary video files is vulnerable to memory corruption, which should probably be taken more seriously.

It isn't even like this is without precedent, the FORCEDENTRY NSO kit used the shitty old JBIG2 parser that Apple was shipping as its entry point despite the fact that approximately nobody was legitimately using JBIG2 in iMessage.

Re: FFmpeg dealing with a security researcher

#14

Post by GaryBluto »

fabrice_d wrote: post #12
GaryBluto wrote: post #8

Rather unprofessional for an official project twitter account to complain about "slop" > We take security very seriously but at the same time is it really fair that trillion dollar corporations run AI to find security issues on people's hobby code? Then expect volunteers to fix. Yes. If a vulnerability exists, it's wise to report it. You don't need to fix it immediately (nobody has got a gun to your head) but just be…

It is absolutely Google's security issue if they use an open source project with that license: https://git.ffmpeg.org/gitweb/ffmpeg.git/blob/HEAD:/COPYING.... and then expect volunteers to provide them fixes.

It's not just Google who could be affected by this.

> and then expect volunteers to provide them fixes.

Expect volunteers to provide everyone using the software with fixes.

Re: FFmpeg dealing with a security researcher

#15

Post by paradox460 »

GaryBluto wrote: post #8

Rather unprofessional for an official project twitter account to complain about "slop" > We take security very seriously but at the same time is it really fair that trillion dollar corporations run AI to find security issues on people's hobby code? Then expect volunteers to fix. Yes. If a vulnerability exists, it's wise to report it. You don't need to fix it immediately (nobody has got a gun to your head) but just be…

You get what you pay for.

Re: FFmpeg dealing with a security researcher

#17

Post by haskellshill »

GaryBluto wrote: post #8

Rather unprofessional for an official project twitter account to complain about "slop" > We take security very seriously but at the same time is it really fair that trillion dollar corporations run AI to find security issues on people's hobby code? Then expect volunteers to fix. Yes. If a vulnerability exists, it's wise to report it. You don't need to fix it immediately (nobody has got a gun to your head) but just be…

Yeah, I mean if it's an actual vulnerability what are they complaining for?

Re: FFmpeg dealing with a security researcher

#18

Post by sillywabbit »

GaryBluto wrote: post #14
fabrice_d wrote: post #12

Earlier quoted context omitted.

It is absolutely Google's security issue if they use an open source project with that license: https://git.ffmpeg.org/gitweb/ffmpeg.git/blob/HEAD:/COPYING.... and then expect volunteers to provide them fixes.

It's not just Google who could be affected by this. > and then expect volunteers to provide them fixes. Expect volunteers to provide everyone using the software with fixes.

For a bug in the LucasArts Smush codec? Why didn't you verify it was an mp4/h264 first?

Re: FFmpeg dealing with a security researcher

#19

Post by _flux »

PaulKeeble wrote: post #4

"Just send patches" is I think the main point. Rather than just reporting security bugs these big organisations ought to start seeing the point of open source being that can and should be contributing if they value the project and need this fixed because its a pretty obscure problem generated by AI.

Perhaps it'll be sooner than you expect: actually having proper fixes made by AI for the issues found with AI.
Post reply on HN