Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

161–170 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#161

Post by iscoelho »

pjmlp wrote: post #63

Fully on FFmpeg team side, many companies approach to FOSS is only doing so when it sounds good on their marketing karma, leech otherwise. Most of them would just pirate in the old days, and most FOSS licences give them clear conscience to behave as always.

Google is, at no cost to FFMPEG:

1) dedicating compute resources to continuously fuzzing the entire project

2) dedicating engineering resources to validating the results and creating accurate and well-informed bug reports (in this case, a seriously underestimated security issue)

3) additionally for codecs that Google likely does not even internally use or compile, purely for the greater good of FFMPEG's user base

Needless to say, while I agree Google has a penny to spare to fund FFMPEG, and should (although they already contribute), I do not agree with funding this maintainer.

Re: FFmpeg to Google: Fund us or stop sending bugs

#162

Post by tanvach »

ranger_danger wrote: post #134
inerte wrote: post #102

Earlier quoted context omitted.

If you're going to fix the bug, why not in the main project?

Any time I have tried to fix a bug in an open source project I was immediately struck down with abusive attitudes about how I didn't do something exactly the way they wanted it that isn't really documented. If that's what I have to expect, I'd rather not even interact with them at all.

If you really care, I would suggest helping with documenting how the process should work for others to reference going forward.

Re: FFmpeg to Google: Fund us or stop sending bugs

#163

Post by godshatter »

omnicognate wrote: post #47
cogman10 wrote: post #44

Earlier quoted context omitted.

Sure but how. Let's say that FFMPEG has a 10 CVE where a very easy stream can cause it to RCE. So what? We are talking about software commonly for end users deployed to encode their own media. Something that rarely comes in untrusted forms. For an exploit to happen, you need to have a situation where an attacker gets out a exploited media file which people commonly transcode via FFMPEG. Not an easy task. This sure do…

AIUI, (lib)ffmpeg is used by practically everything that does anything with video, including such definitely-security-sensitive things as Chrome, which people use to play untrusted content all the time.

Then maybe the Google chrome devs should submit a PR to ffmpeg.

Re: FFmpeg to Google: Fund us or stop sending bugs

#164

Post by themafia »

vsgherzi wrote: post #146

I understand ffmpeg being angry at the workload but this is how it is with large open source projects. Ffmpeg has no obligation to fix any of this. Open source is a gift and is provided as is. If Google demanded a fix I could see this being an issue. As it is right now it just seems like a bad look. If they wanted compensation then they should change the model, there's nothing wrong with that. Google found a bug, the…

> Google found a bug

That does not impact their business or their operations in any way whatsoever.

> If it's a valid bug then it's a valid bug end of story.

This isn't a binary. It's why CVEs have a whole sordid scoring system to go along with them.

> Software owes it to its users to be secure

ffmpeg owes me nothing. I haven't paid them a dime.

Re: FFmpeg to Google: Fund us or stop sending bugs

#165

Post by cestith »

esrauch wrote: post #153
PeaceTed wrote: post #130

Earlier quoted context omitted.

This is why many have warned against things like MIT licence. Yes, it gives you source code and does easily get incorporated into a lot of projects but it comes at the cost of potential abuse. Yes, GPL 3 is a lot ideologically but it was trying to limit excessive leeching. Now that I have opened the flood gates of a 20 year old debate, time to walk away.

Google Project Zero just looks for security issues in popular open source packages, regardless of if Google itself even uses those packages or not. So I'm not sure what GPLv3 really has to do with it in this case, if it under was a "No billion dollar company allowed" non-free-but-source-available license, this same thing would have happened if the project was popular enough for Project Zero to have looked at it for s…

The difference is that Google does use it, though. They use it heavily. All of us in the video industry do - Google, Amazon, Disney, Sony, Viacom, or whoever. Companies you may have never heard of build it into their solutions that are used by big networks and other streaming services, too.

Re: FFmpeg to Google: Fund us or stop sending bugs

#166

Post by Seattle3503 »

> “The position of the FFmpeg X account is that somehow disclosing vulnerabilities is a bad thing. Google provides more assistance to open source software projects than almost any other organization, and these debates are more likely to drive away potential sponsors than to attract them.”

This position likely to drive away maintainers. Generally the maintainers need these projects less than the big companies that use them. I'm not sure what Google's endgame is

Re: FFmpeg to Google: Fund us or stop sending bugs

#167

Post by noir_lord »

kwanbix wrote: post #57
doctorwho42 wrote: post #51

Earlier quoted context omitted.

What's wild is the importance and impact of the work/tool. And for google and Amazon, $50k-$100k/yr isn't even a single engineer salary to them ... And they get the tool + community good will, all for a rounding error on any part of their budgets...

Exactly. That is why I said easily 100~200k. It will be a rounding error for them. It is actually crazy that Google is not already hiring the main dev to work on ffmpeg with all the use they give it on Youtube. I also wonder if it is maybe used by Netflix also.

> I also wonder if it is maybe used by Netflix also.

They do and it is.

https://netflixtechblog.com/the-making-of-ves-the-cosmos-mic...

https://netflixtechblog.com/for-your-eyes-only-improving-net...

Re: FFmpeg to Google: Fund us or stop sending bugs

#168

Post by zrm »

arrowleaf wrote: post #120
wewtyflakes wrote: post #115

Earlier quoted context omitted.

Sounds like it would be a lot of churn for nothing; if they can fund a fork, then they could fund the original project, no?

If they can fund a fork, they can continue business as usual until the need arises

A fork is more expensive to maintain than funding/contributing to the original project. You have to duplicate all future work yourselves, third party code starts expecting their version instead of your version, etc.

Re: FFmpeg to Google: Fund us or stop sending bugs

#169

Post by cortesoft »

wewtyflakes wrote: post #115
NewsaHackO wrote: post #101

Earlier quoted context omitted.

But if it gets relicensed, they would still be able to use the current version. Amazon definitely would be able to fund an independent fork.

Sounds like it would be a lot of churn for nothing; if they can fund a fork, then they could fund the original project, no?

They COULD, but history has shown they would rather start and maintain their own fork.

It might not make sense morally, but it makes total sense from a business perspective… if they are going to pay for the development, they are going to want to maintain control.

Post reply on HN