Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

141–150 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#141

Post by nimih »

zxspectrum1982 wrote: post #75
phkahler wrote: post #54

From TFA this was telling: Thus, as Mark Atwood, an open source policy expert, pointed out on Twitter, he had to keep telling Amazon to not do things that would mess up FFmpeg because, he had to keep explaining to his bosses that “They are not a vendor, there is no NDA, we have no leverage, your VP has refused to help fund them, and they could kill three major product lines tomorrow with an email. So, stop, and liste…

Google is not paying anyone to find bugs. They are running AIs indiscriminately.

They certainly paid someone to run the so-called AIs.

Re: FFmpeg to Google: Fund us or stop sending bugs

#142

Post by iscoelho »

It’s a reproducible use-after-free in a codec that ships by default with most desktop and server distributions.

The recent iOS zero-day (CVE-2025-43300) targeted the rarely used DNG image format. How long before this FFMPEG vulnerability is exploited to compromise legacy devices in the wild, I wonder?

I’m not a fan of this grandstanding for arguably questionable funding. (I surely would not fund those who believe these issues are slop.) I’d like to think most contributors already understand the severity and genuinely care about keeping FFMPEG secure.

Re: FFmpeg to Google: Fund us or stop sending bugs

#143

Post by PeaceTed »

bogwog wrote: post #93

Is it time for FFmpeg to relicense as AGPL? That'd be fun to witness.

Watch places like Amazon and Google suddenly stop updating and trying to find alternatives.

Like how Apple stopped using up to date the GNU tools in 2008 because of GPL3. That moved showed me then that Apple did not want you to use your computer as your computer.

Re: FFmpeg to Google: Fund us or stop sending bugs

#144

Post by jakeydus »

rsanek wrote: post #138
eddd-ddde wrote: post #127

Earlier quoted context omitted.

So your claim is that buggy software is better than documented buggy software?

I think so, yes. Certainly it's more effort to both find and exploit a bug than to simply exploit an existing one someone else found for you.

Yeah it's more effort, but I'd argue that security through obscurity is a super naive approach. I'm not on Google's side here, but so much infrastructure is "secured" by gatekeeping knowledge.

Re: FFmpeg to Google: Fund us or stop sending bugs

#146

Post by vsgherzi »

I understand ffmpeg being angry at the workload but this is how it is with large open source projects. Ffmpeg has no obligation to fix any of this. Open source is a gift and is provided as is. If Google demanded a fix I could see this being an issue. As it is right now it just seems like a bad look. If they wanted compensation then they should change the model, there's nothing wrong with that. Google found a bug, they reported it. If it's a valid bug then it's a valid bug end of story. Software owes it to its users to be secure, but again it's up to the maintainers if they also believe that. Maybe this pushes Google to make an alternative, which I'd be excited for.

Re: FFmpeg to Google: Fund us or stop sending bugs

#147

Post by esrauch »

blibble wrote: post #5
ranger_danger wrote: post #3

Wouldn't they just fork it, fix their own bugs and stop contributing at all?

Google internally maintaining a fork that attempts to track upstream has a ongoing cost that increases over time vs. spamming OSS maintainers with slop reports costs Google nothing

Is there really slop here though? It sounds like the specific case identified was a real use after free in an obscure file format but which is enabled by default.

If it was slop they could complain that it was wasting their time on false or unimportant reports, instead they seem to be complaining that the program reported a legitimate security issue?

Re: FFmpeg to Google: Fund us or stop sending bugs

#148

Post by joshkel »

skrebbel wrote: post #73
phkahler wrote: post #54

From TFA this was telling: Thus, as Mark Atwood, an open source policy expert, pointed out on Twitter, he had to keep telling Amazon to not do things that would mess up FFmpeg because, he had to keep explaining to his bosses that “They are not a vendor, there is no NDA, we have no leverage, your VP has refused to help fund them, and they could kill three major product lines tomorrow with an email. So, stop, and liste…

How could ffmpeg maintainers kill three major AWS product lines with an email?

In a follow-up tweet, Mark Atwood eloborates: "Amazon was very carefully complying with the licenses on FFmpeg. One of my jobs there was to make sure the company was doing so. Continuing to make sure the company was was often the reason I was having a meeting like that inside the company."

I interpret this as meaning there was an implied "if you screw this up" at the end of "they could kill three major product lines with an email."

Re: FFmpeg to Google: Fund us or stop sending bugs

#149

Post by nemothekid »

vadansky wrote: post #35
Msurrow wrote: post #24

Earlier quoted context omitted.

My takeaway from the article was not that the report was a problem, but a change in approach from Google that they’d disclose publicly after X days, regardless of if the project had a chance to fix it. To me its okay to “demand” from a for profit company (eg google) to fix an issue fast. Because they have ressources. But to “demand” that an oss project fix something with a certain (possibly tight) timeframe.. well I’…

On the other hand as an ffmpeg user do you care? Are you okay not being told a tool you're using has a vulnerability in it because the devs don't have time to fix it? I mean someone could already be using the vulnerability regardless of what Google does.

>Are you okay not being told a tool you're using has a vulnerability in it because the devs don't have time to fix it?

Yes? It's in the license

>NO WARRANTY

>15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

If I really care, I can submit a patch or pay someone to. The ffmpeg devs don't owe me anything.

Re: FFmpeg to Google: Fund us or stop sending bugs

#150

Post by rebelwebmaster »

conradev wrote: post #74
cogman10 wrote: post #64

Earlier quoted context omitted.

hmm, didn't realize chrome was using ffmpeg in the background. That definitely makes it more dangerous than I supposed. Looks like firefox does the same.

Firefox has moved some parsers to Rust: https://github.com/mozilla/mp4parse-rust

Firefox also does a lot of media decoding in a separate process.
Post reply on HN