Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

251–260 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#251

Post by gnfargbl »

pjmlp wrote: post #177
iscoelho wrote: post #161

Earlier quoted context omitted.

Google is, at no cost to FFMPEG: 1) dedicating compute resources to continuously fuzzing the entire project 2) dedicating engineering resources to validating the results and creating accurate and well-informed bug reports (in this case, a seriously underestimated security issue) 3) additionally for codecs that Google likely does not even internally use or compile, purely for the greater good of FFMPEG's user base Nee…

Then they can surely also provide a pull request for said CVE.

They could, but there is really no requirement on them to do so. The security flaw was discovered by Google, but it was not created by them.

Equally there is no requirement on ffmpeg to fix these CVEs nor any other.

And, of course, there is no requirement on end-users to run software from projects which do not consider untrusted-input-validation bugs to be high priority.

Re: FFmpeg to Google: Fund us or stop sending bugs

#252

Post by gowld »

janalsncm wrote: post #242
nemothekid wrote: post #149

Earlier quoted context omitted.

> Are you okay not being told a tool you're using has a vulnerability in it because the devs don't have time to fix it? Yes? It's in the license > NO WARRANTY > 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANT…

All the license means is that I can’t sue them. It doesn’t mean I have to like it. Just because software makes no guarantees about being safe doesn’t mean I want it to be unsafe.

If the software makes no guarantees about being safe, then you should assume it is unsafe.

Re: FFmpeg to Google: Fund us or stop sending bugs

#253

Post by tom_ »

FridgeSeal wrote: post #228
skybrian wrote: post #181

Here's a thread by Google's head of security that notes the ways they've contributed to FFmpeg over the years: https://x.com/argvee/status/1986194852669964528

Unfortunately, nobody not on Twitter can see anything except the first message, which just appears to be some corporate-deflection-speak. It’s a trillion dollar company. I’m sure they could find rifle through their couch cushions and find more than enough money and under-utilised devs to contribute finance or patches.

Try xcancel instead: https://xcancel.com/argvee/status/1986194852669964528

Re: FFmpeg to Google: Fund us or stop sending bugs

#254

Post by rolandog »

edoceo wrote: post #182
cortesoft wrote: post #169

Earlier quoted context omitted.

They COULD, but history has shown they would rather start and maintain their own fork. It might not make sense morally, but it makes total sense from a business perspective… if they are going to pay for the development, they are going to want to maintain control.

If they want that level of control, reimburse for all the prior development too. - ie: buy that business. As it stands, they're just abusing someone's gift. Like jerks.

There should be a "if you use this product in a for-profit environment, and you have a yearly revenue of $500,000,000,000+ ... you can afford to pay X * 100,000/yr" license.

Re: FFmpeg to Google: Fund us or stop sending bugs

#255

Post by noir_lord »

kwanbix wrote: post #176
noir_lord wrote: post #167

Earlier quoted context omitted.

> I also wonder if it is maybe used by Netflix also. They do and it is. https://netflixtechblog.com/the-making-of-ves-the-cosmos-mic... https://netflixtechblog.com/for-your-eyes-only-improving-net...

It is really sad that none of Netflix or Google had hired a couple of devs to work full time on ffmpeg.

I'd be amazed if any of the FAANG's isn't putting real money through ffmpeg somewhere.

So yeah it'd be nice if they put some real money (to ffmpeg - wouldn't be their coffee allowance to any of them) into it.

Almost everything that touches video at some point uses it.

Re: FFmpeg to Google: Fund us or stop sending bugs

#256

Post by dylan604 »

vadansky wrote: post #35
Msurrow wrote: post #24

Earlier quoted context omitted.

My takeaway from the article was not that the report was a problem, but a change in approach from Google that they’d disclose publicly after X days, regardless of if the project had a chance to fix it. To me its okay to “demand” from a for profit company (eg google) to fix an issue fast. Because they have ressources. But to “demand” that an oss project fix something with a certain (possibly tight) timeframe.. well I’…

On the other hand as an ffmpeg user do you care? Are you okay not being told a tool you're using has a vulnerability in it because the devs don't have time to fix it? I mean someone could already be using the vulnerability regardless of what Google does.

In my case, yes, but my pipeline is closed. Processes run on isolated instances that are terminated without haste as soon as workflow ends. Even if uncaught fatal errors occur, janitor scripts run to ensure instances are terminated on a fast schedule. This isn't something running on my personal device with random content that was provided by unknown someone on the interwebs.

So while this might be a high security risk because it possibly could allow RCE, the real-world risk is very low.

Re: FFmpeg to Google: Fund us or stop sending bugs

#257

Post by criticalfault »

samdoesnothing wrote: post #121
profsummergig wrote: post #8

A bunch of people who make era-defining software for free. A labor of love. Another bunch of people who make era-defining software where they extract everything they can. From customers, transactionally. From the first bunch, pure extraction (slavery, anyone?).

It's hard to find an easier good vs evil distinction than between Google and literally anybody else.

Microsoft ♥ Linux?

Re: FFmpeg to Google: Fund us or stop sending bugs

#258

Post by gowld »

jancsika wrote: post #240
kwanbix wrote: post #32

Earlier quoted context omitted.

How do you think Jeff got a 500 million dollars yacht? Not by writing checks. But on a more serious note, it is crazy that between Google and Amazon they can not fund them with 50k each per year, so that they can pay people to work on this. Specially Google, with Youtube, they can very easily pay them more. 100k~200k easily.

If I had built up 500 million in a savings account to buy a yacht, giving 50k of that to FFmpeg devs would put off my ability to buy a yacht by nearly a whole day. Boltzmann brain-wise it clearly doesn't make sense to wait that long.

Cheating on your wife would put off your ability to buy that yacht off by 20 years, and yet here we are.

Re: FFmpeg to Google: Fund us or stop sending bugs

#259

Post by [deleted] »

FridgeSeal wrote: post #228
skybrian wrote: post #181

Here's a thread by Google's head of security that notes the ways they've contributed to FFmpeg over the years: https://x.com/argvee/status/1986194852669964528

Unfortunately, nobody not on Twitter can see anything except the first message, which just appears to be some corporate-deflection-speak. It’s a trillion dollar company. I’m sure they could find rifle through their couch cushions and find more than enough money and under-utilised devs to contribute finance or patches.

[deleted]

Re: FFmpeg to Google: Fund us or stop sending bugs

#260

Post by gowld »

cestith wrote: post #172
ChrisMarshallNY wrote: post #156

Looks like this was a security issue. I don't consider a security issue to be a "standard bug." I need to look at it, and [maybe] fix it, regardless of who reported it. But in my projects, I have gotten requests (sometimes, demands) that I change things like the published API (a general-purpose API), to optimize some niche functionality for one user. I'll usually politely decline these, and respond with an explanatio…

It’s a security issue for a stream type almost nobody uses. It’s a little like saying your graphics program in 2025 is exploitable by a malformed PCX file, or your music player has a security bug only when playing an Impulse Tracker module. Sure, triage it. It shouldn’t be publicly disclosed within a week of the report though, because the fix is still a relatively low priority.

If no one uses the stream type, then not fixing the bug won't hurt.

The people who do use the stream type are at risk, and have been at risk all along. They need to stop using the stream type, or get the bug fixed, or triage the but as not exploitable.

Post reply on HN