Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

421–430 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#421

Post by zdragnar »

deaddodo wrote: post #329
NewsaHackO wrote: post #101

Earlier quoted context omitted.

But if it gets relicensed, they would still be able to use the current version. Amazon definitely would be able to fund an independent fork.

And then the argument for refusing to just pay ffmpeg developers gets even more flimsy. The entire point here is to pay for the fixes/features you keep demanding, else the project is just going to do as it desires and ignore you. More and more OSS projects are getting to this point as large enterprises (especially in the SaaS/PaaS spheres) continue to take advantage of those projects and treat them like unpaid worker…

Not really. Their whole reason for not funding open source is it essentially funds their competitors who use the same projects. That's why they'd rather build a closed fork in-house than just hand money to ffmpeg.

It's a dumb reason, especially when there are CVE bugs like this one, but that's how executives think.

Re: FFmpeg to Google: Fund us or stop sending bugs

#424

Post by tpmoney »

bogwog wrote: post #93

Is it time for FFmpeg to relicense as AGPL? That'd be fun to witness.

To be clear, what does relicensing to AGPL do here? Does the AGPL include licensing terms that forbid filing bug reports without also including code patches? Or does it just make ffmpeg that much less appealing to projects and cut off the steady stream of contributions that it has gotten from google since 2009? https://git.ffmpeg.org/gitweb/ffmpeg.git/search/HEAD?pg=3;s=...

Re: FFmpeg to Google: Fund us or stop sending bugs

#425

Post by zdragnar »

wewtyflakes wrote: post #115
NewsaHackO wrote: post #101

Earlier quoted context omitted.

But if it gets relicensed, they would still be able to use the current version. Amazon definitely would be able to fund an independent fork.

Sounds like it would be a lot of churn for nothing; if they can fund a fork, then they could fund the original project, no?

Funding ffmpeg also essentially funds their competitors, but a closed fork in-house doesn't. Submitting bugs costs less than both, hence why they still use ffmpeg in the first place.

Re: FFmpeg to Google: Fund us or stop sending bugs

#426

Post by saagarjha »

renhanxue wrote: post #412
jsnell wrote: post #403

Earlier quoted context omitted.

I don't get why you think linking to multiple legitimate and high quality bug reports with detailed analysis and precise reproduction instructions demonstrates "slop". It is the opposite. This is software that is directly or indirectly run by millions of people on untrusted media files without sandboxing. It's not even that they don't care about security, it's that they're unaware that they should care. It should go…

All of these reports are effectively autogenerated by Big Sleep from fuzzing. Again, Google has been doing this sort of thing for over a decade and has found untold thousands of vulnerabilities like this one. It is not at all clear to me that their doing so has been all that valuable.

Google fuzzing open source projects has eliminated a lot of low hanging fruit from being exploited. I am surprised you think that finding these vulnerabilities so they can be fixed has not been valuable.

Re: FFmpeg to Google: Fund us or stop sending bugs

#427

Post by vsgherzi »

theoldgreybeard wrote: post #387
vsgherzi wrote: post #146

I understand ffmpeg being angry at the workload but this is how it is with large open source projects. Ffmpeg has no obligation to fix any of this. Open source is a gift and is provided as is. If Google demanded a fix I could see this being an issue. As it is right now it just seems like a bad look. If they wanted compensation then they should change the model, there's nothing wrong with that. Google found a bug, the…

> Software owes it to its users to be secure. There is no such obligation. There is no warranty and software is provided AS-IS explicitly by the license.

I disagree, as software engineers we owe it to the craft to create correct software especially when we intend to distribute. Anything less is poor taste.

You bring up licensing. I’m not talking about legally I’m talking about a social contract.

Re: FFmpeg to Google: Fund us or stop sending bugs

#428

Post by orangecat »

tpmoney wrote: post #373
Y-bar wrote: post #324

Earlier quoted context omitted.

> They could, but there is really no requirement on them to do so. I see this sort of sentiment daily. The sentiment that only what is strictly legal or required is what matters. Sometimes, you know, you have to recognise that there are social norms and being a good person matters and has intrinsic value. A society only governed by what the written law of the land explicitly states is a dystopia worse than hell.

What's "strictly legal or required" of Google here is absolutely nothing. They didn't have to do any auditing or bug hunting. They certainly didn't have to validate or create a proper bug report, and there's no requirement whatsoever that they tell anyone about it at all. They could have found the bug, found it was being actively exploited, made their own internal patch and sat quietly by while other people remained…

Google did more than what is "strictly legal or required", and what they did was submit a good and valid bug report. But for some reason we're mad because they didn't do even more. Why?

The Copenhagen Interpetation of Ethics is annoyingly prevalent (https://forum.effectivealtruism.org/posts/QXpxioWSQcNuNnNTy/...)

Re: FFmpeg to Google: Fund us or stop sending bugs

#429

Post by saagarjha »

dotancohen wrote: post #340
inkysigma wrote: post #210

Earlier quoted context omitted.

Not being told the existence of bugs is different from having a warranty on software. How would you submit a patch on a bug you were not aware of? Google should provide a fix but it's been standard to disclose a bug after a fixed time because the lack of disclosure doesn't remove the existence of the bug. This might have to be rethought in the context of OSS bugs but an MIT license shouldn't mean other people can't d…

Google publicly disclosing the bug doesn't only let affected users know. It also lets attackers know how they can exploit the software. Holding public disclosure over the heads of maintainers if they don't act fast enough is damaging not only to the project, but to end users themselves also. There was no pressing need to publicly disclose this 25 year old bug.

Come on, we let this argument die a decade ago. Disclosure timelines that match what the software author wants is a courtesy, not a requirement.

Re: FFmpeg to Google: Fund us or stop sending bugs

#430

Post by saagarjha »

khannn wrote: post #407
tpmoney wrote: post #385

Earlier quoted context omitted.

Great, so Google is actively spending money on making open source projects better and more secure. And for some reason everyone is now mad at them for it because they didn't also spend additional money making patches themselves. We can absolutely wish and ask that they spend some money and resources on making those patches, but this whole thing feels like the message most corporations are going to take is "don't do a…

They're actively making open source projects less secure by publishing bugs that the projects don't have the volunteers to fix I saw another poster say something about "buggy software". All software is buggy.

Publishing bugs that the project has so that they can be fixed is actively making the project more secure. How is someone going to do anything about it if Google didn’t do the research?
Post reply on HN