[flagged]
[flagged]
Germany's Sovereign Tech Fund Now Supporting FFmpeg
31–40 of 55 posts
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#32[flagged]
You're not wrong. Media codecs are a good attack vector. However, it's not so simple. You need hand crafted SIMD to reach desired performance. That is a whole area of specialized theory and research. I think it should be done, but who is going to fund it?
You don't necessarily need all the code to be fast. I think writing correctness validators in a memory-safe language would go a long way toward securing media formats. Run the validator on all untrusted media to confirm it strictly conforms to the specification before playing it in the fast-but-unsafe player. This should make things a lot more difficult for attackers. As a bonus, it would be a useful debugging tool for encoders.
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#33[flagged]
You are getting down voted, but you aren't really wrong, there have been 142 vulnerabilities[1] in ffmpeg since 2018, 3 in this year so far. The attack surface is huge, with mostly memory corruption issues being found.
Not sure rust is the answer or what else could be done, but we shouldn't pretend it isn't an issue.
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#34Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#35[flagged]
For an enormous project like this, it is probably more reasonable to just use the latest version of C, and turn on lots of linters and sanitizers. You could also use one of the various strict subsets of C that is oriented for safety. Might as well tell people to rewrite WebKit or Linux in Rust. There are projects that aim at building browsers or kernels in Rust, but the man-millennia of effort put into the existing p…
[deleted]
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#36This is great news, but simultaneously disappointing that it is necessary. FFmpeg underpins tens of billions of dollars in value for the companies that use it, yet the support from the community is proportionally minuscule.
It's weird when you consider how much money corporations waste on complete bs that they can't set aside a tiny amount to support the software they use.
So weird, it sounds like a conspiracy theory.
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#37This is great news, but simultaneously disappointing that it is necessary. FFmpeg underpins tens of billions of dollars in value for the companies that use it, yet the support from the community is proportionally minuscule.
It's weird when you consider how much money corporations waste on complete bs that they can't set aside a tiny amount to support the software they use. So weird, it sounds like a conspiracy theory.
What's the conspiracy? Why would a company support a Free software project if it didn't have to, out of the good of its heart?
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#38It's very good that ffmpeg gets support and the sovereign tech fund is a good idea but for me it again just highlights how perverted the incentives to support open source are. Millions of dollars are extracted by using ffmpeg from a lot of corporations, yet the German taxpayer pays for maintenance.
before any of us bein patting ourselves on the back, It's prolly best to acknowledge that without Frances copyright laws this project along with many others would've been killed by lawyers.
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#39[deleted]
Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg
#40It's very good that ffmpeg gets support and the sovereign tech fund is a good idea but for me it again just highlights how perverted the incentives to support open source are. Millions of dollars are extracted by using ffmpeg from a lot of corporations, yet the German taxpayer pays for maintenance.
before any of us bein patting ourselves on the back, It's prolly best to acknowledge that without Frances copyright laws this project along with many others would've been killed by lawyers.
> before any of us bein patting ourselves on the back, It's prolly best to acknowledge that without Frances copyright laws this project along with many others would've been killed by lawyers.
How are French copyright laws responsible for this?