Earlier quoted context omitted.
Time to RIIR, then?
I haven't seen that acronym before, but my guess is that it's "Re-Implement In Rust", right?
Usually it's Rewrite it in Rust, but both work I guess
Twenty One Zero-Days in FFmpeg
101–110 of 216 posts
Re: Twenty One Zero-Days in FFmpeg
#102Ffmpeg has an exceptionally terrible track record when it comes to security. People have been throwing fuzzers at it for as long as I remember and coming back with a nearly inexhaustible supply of memory corruption bugs. Here's an effort by one Googler a decade ago: https://security.googleblog.com/2014/01/ffmpeg-and-thousand-... So, while it's a demo of the capabilities of LLMs, this should not be at all surprising.…
Of course. Everybody knows to rather use the obvious alternative to ffmpeg!
Re: Twenty One Zero-Days in FFmpeg
#103I think the industry is optimizing for the wrong thing. Generating thousands of AI-written bug reports is easy, at least with Mythos (preview 1) or GPT-5.5. Getting bugs fixed is the hard part. A few months ago I started working on a system that finds critical security issues and opens PRs instead of just filing reports. The acceptance rate is sitting at roughly 94% so far. Most of the failures were due to project-sp…
I think I'm missing something here. Apple software has no open source code, how are you suggesting fixes?
Re: Twenty One Zero-Days in FFmpeg
#104Earlier quoted context omitted.
[flagged]
So who is someone who's opinion is worth anything to you? Except yourself, presumably, to me it almost seems nobody is perfect.
On this subject I'd at minimum expect someone with experience in security. Not someone most famously known for making toys that run on computers.
Re: Twenty One Zero-Days in FFmpeg
#105Re: Twenty One Zero-Days in FFmpeg
#106[flagged]
Re: Twenty One Zero-Days in FFmpeg
#107> The reach of this bug is what makes it serious. Any deployment that points FFmpeg at an attacker-influenced RTSP URL is exposed: media ingest pipelines fetching user-supplied stream URLs, surveillance and CCTV systems pulling RTSP feeds, and transcoding services processing remote AV1-over-RTP sources Wow this is actually pretty serious - I'm even surprised its being published. There are several services where I can…
ffmpeg has stated many many times that they don't care about bug or security reports
Re: Twenty One Zero-Days in FFmpeg
#108Earlier quoted context omitted.
So who is someone who's opinion is worth anything to you? Except yourself, presumably, to me it almost seems nobody is perfect.
On this subject I'd at minimum expect someone with experience in security. Not someone most famously known for making toys that run on computers.
I've seen a lot of things written about Carmack over the last 30+ years, not one comment this casually dismissive until today.
Re: Twenty One Zero-Days in FFmpeg
#109Earlier quoted context omitted.
Funny, John Carmack was just admiring the creator of ffmpeg the other day for being a better programmer. https://x.com/id_aa_carmack/status/2064095424420487226?s=46
[flagged]
I don't think that's fair. There's a lot of talent and grit behind ffmpeg. But for better or worse, getting the code to do what it's supposed to do requires a different mindset than getting it to not do anything else (i.e., to handle malicious inputs correctly).
The developers of ffmpeg are very good at the first thing and not very good at the second. But few people on this planet, if instructed to write a complex video format parser in C or assembly, can produce something that's secure on the first try. The main failing of the ffmpeg team is that they should have spent more time on architectural hardening and mitigations. Most other large projects of this type do.