Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Germany's Sovereign Tech Fund Now Supporting FFmpeg

phoronix.com

Post reply on HN
Print view View original

41–50 of 55 posts

Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg

#41

Post by tstrimple »

IshKebab wrote: post #15
xnyan wrote: post #12

Earlier quoted context omitted.

Serious question, let's say you had a ton of money and wanted to get this done, is there physically enough available Rust talent (at market rates) in the world today to port ffmpeg to rust in any reasonable amount of time? My understanding is that it's one of the biggest open source projects in terms of LoC, development hours needed to both create and maintain, and number of former and active developers working on th…

There definitely is. You don't need support for all the obscure formats that ffmpeg supports. It would still cost a lot though.

If it doesn’t support the formats, it’s not a replacement for ffmpeg. It’s a competitor with fewer capabilities. I’m sure people will flock to that just for the excuse of saying they are using a rust library.

Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg

#42

Post by tstrimple »

lyu07282 wrote: post #33
bestouff wrote: post #2

[flagged]

You are getting down voted, but you aren't really wrong, there have been 142 vulnerabilities[1] in ffmpeg since 2018, 3 in this year so far. The attack surface is huge, with mostly memory corruption issues being found. Not sure rust is the answer or what else could be done, but we shouldn't pretend it isn't an issue. [1] https://stack.watch/product/ffmpeg/ffmpeg/

So they found and fixed 142 vulnerabilities in the last 3 years and folks are advocating for them to abandon all that good work and build a new framework from scratch which reintroduces tons more bugs that are completely undiscovered. Seems like an insane path to stability to me.

Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg

#43

Post by lyu07282 »

tstrimple wrote: post #42
lyu07282 wrote: post #33

Earlier quoted context omitted.

You are getting down voted, but you aren't really wrong, there have been 142 vulnerabilities[1] in ffmpeg since 2018, 3 in this year so far. The attack surface is huge, with mostly memory corruption issues being found. Not sure rust is the answer or what else could be done, but we shouldn't pretend it isn't an issue. [1] https://stack.watch/product/ffmpeg/ffmpeg/

So they found and fixed 142 vulnerabilities in the last 3 years and folks are advocating for them to abandon all that good work and build a new framework from scratch which reintroduces tons more bugs that are completely undiscovered. Seems like an insane path to stability to me.

You are missing the point. Nearly 100% of those bugs are due to the fact that it is written in a memory unsafe language, FFmpeg is 23 years old and we still find memory corruption bugs in it every few months. That's why people are saying to perhaps use a memory safe language instead, I don't understand why people give this such a hostile response, it has been widely accepted that C is dangerous and can not ever be made safe, to suggest anything different is denying reality.

Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg

#44

Post by bogantech »

jallmann wrote: post #25

This is great news, but simultaneously disappointing that it is necessary. FFmpeg underpins tens of billions of dollars in value for the companies that use it, yet the support from the community is proportionally minuscule.

It's necessary because anytime there's talk about the original authors of open source software making money rather than big corps everyone starts frothing at the mouth and forking things to protect the leeches.

Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg

#45

Post by bogantech »

lyu07282 wrote: post #43
tstrimple wrote: post #42

Earlier quoted context omitted.

So they found and fixed 142 vulnerabilities in the last 3 years and folks are advocating for them to abandon all that good work and build a new framework from scratch which reintroduces tons more bugs that are completely undiscovered. Seems like an insane path to stability to me.

You are missing the point. Nearly 100% of those bugs are due to the fact that it is written in a memory unsafe language, FFmpeg is 23 years old and we still find memory corruption bugs in it every few months. That's why people are saying to perhaps use a memory safe language instead, I don't understand why people give this such a hostile response, it has been widely accepted that C is dangerous and can not ever be ma…

A lot of it is written in ASM for performance reasons.

Besides that, there's always a bunch of "this should be rewritten completely in " as if it's trivial to rewrite software like this from scratch but nobody ever steps up and does it, I wonder why that is?

Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg

#46

Post by harha »

ChrisMarshallNY wrote: post #10

Glad to hear this. ffmpeg is one of these "Too Important to Fail" libraries. I'll lay odds that billions of dollars rely on it, and it's an open-source tool.

This is creating bad incentives - now the billions of dollars relying on that have no interest in fixing the issue and they'll do the same for other projects.

Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg

#47

Post by ChrisMarshallNY »

harha wrote: post #46
ChrisMarshallNY wrote: post #10

Glad to hear this. ffmpeg is one of these "Too Important to Fail" libraries. I'll lay odds that billions of dollars rely on it, and it's an open-source tool.

This is creating bad incentives - now the billions of dollars relying on that have no interest in fixing the issue and they'll do the same for other projects.

Or … we could look at it as a type of “Local Loop Unbundling,” ensuring that it acts as a neutral resource for all.

Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg

#48

Post by IshKebab »

tstrimple wrote: post #41
IshKebab wrote: post #15

Earlier quoted context omitted.

There definitely is. You don't need support for all the obscure formats that ffmpeg supports. It would still cost a lot though.

If it doesn’t support the formats, it’s not a replacement for ffmpeg. It’s a competitor with fewer capabilities. I’m sure people will flock to that just for the excuse of saying they are using a rust library.

> If it doesn’t support the formats, it’s not a replacement for ffmpeg.

That's dumb. Like saying a car isn't a replacement for a horse because it can't jump over hedges. Most people do not care about the obscure formats at all.

> I’m sure people will flock to that just for the excuse of saying they are using a rust library.

Well, for not having to worry about trivial security bugs, yes I suspect they would flock to it! Especially for server side video processing.

Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg

#49

Post by jongjong »

idle_zealot wrote: post #37
jongjong wrote: post #36

Earlier quoted context omitted.

It's weird when you consider how much money corporations waste on complete bs that they can't set aside a tiny amount to support the software they use. So weird, it sounds like a conspiracy theory.

What's the conspiracy? Why would a company support a Free software project if it didn't have to, out of the good of its heart?

For the same reason that they hire cleaners to clean the windows of their buildings and pay people to check cables in their data centers. To make sure that their business isn't going to fall apart.

Re: Germany's Sovereign Tech Fund Now Supporting FFmpeg

#50

Post by xnyan »

IshKebab wrote: post #48
tstrimple wrote: post #41

Earlier quoted context omitted.

If it doesn’t support the formats, it’s not a replacement for ffmpeg. It’s a competitor with fewer capabilities. I’m sure people will flock to that just for the excuse of saying they are using a rust library.

> If it doesn’t support the formats, it’s not a replacement for ffmpeg. That's dumb. Like saying a car isn't a replacement for a horse because it can't jump over hedges. Most people do not care about the obscure formats at all. > I’m sure people will flock to that just for the excuse of saying they are using a rust library. Well, for not having to worry about trivial security bugs, yes I suspect they would flock to i…

> That's dumb. Like saying a car isn't a replacement for a horse because it can't jump over hedges.

A car is not a replacement for a horse, it's a replacement for what was the most common use case of the horse, getting from A->B in a developed environment. There are still (limited) applications where a horse is the best or only transportation option.

A pocket knife is not a replacement for a multitool, even if the multitool blade gets used more than any other feature. People use multitools because they want something that can solve multiple problems with a single tool. The greatest feature and the reason people reach for ffmpeg is that it's extremely versatile. If you get rid of that versatility, it's not a replacement for ffmpeg.

Post reply on HN