Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

481–490 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#481

Post by Kim_Bruning »

zdragnar wrote: post #421
deaddodo wrote: post #329

Earlier quoted context omitted.

And then the argument for refusing to just pay ffmpeg developers gets even more flimsy. The entire point here is to pay for the fixes/features you keep demanding, else the project is just going to do as it desires and ignore you. More and more OSS projects are getting to this point as large enterprises (especially in the SaaS/PaaS spheres) continue to take advantage of those projects and treat them like unpaid worker…

Not really. Their whole reason for not funding open source is it essentially funds their competitors who use the same projects. That's why they'd rather build a closed fork in-house than just hand money to ffmpeg. It's a dumb reason, especially when there are CVE bugs like this one, but that's how executives think.

But their competitors also fund them, which makes it a net positive sum.

Re: FFmpeg to Google: Fund us or stop sending bugs

#483

Post by Aurornis »

ksynwa wrote: post #124

What is the point of Google's Project Zero? I'm not being dismissive. I understand the imperetive of identifying and fixing vulnerabilities. I also understand the detrimental impact that these problems can potentially have on Google. What I don't understand is the choice to have a public facing project about this. Can anyone shine a light on this?

Honestly it seems kind of weird that HN comments are becoming so hostile toward a company hiring security researchers and having them do free security research on popular projects, then giving away the results for free.

There are many groups and companies that do security research on common software and then sell the resulting vulnerabilities to people who don’t have your best interests in mind. Having a major company get ahead of this and share the results is a win for all of us.

A lot of people in this comment section don’t understand the broader security ecosystem. There are many vendors who will even provide patched versions of software to work around security issues that aren’t yet solved upstream. Some times these patches disable features or break functionality, or simply aren’t at a level where upstream is interested yet. But patching known issues is valuable.

Getting patches accepted upstream in big open source projects isn’t always easy. They tend to want things done a certain way or have a high bar to clear for anyone submitting work.

Re: FFmpeg to Google: Fund us or stop sending bugs

#484

Post by HDThoreaun »

saagarjha wrote: post #437
HDThoreaun wrote: post #370

Earlier quoted context omitted.

This is all true(maybe not the extortion being worse hard to say), but it doesnt change the fact that publishing the CVE is a demand to fix it.

No, it is a request to fix it. How the maintainer feels about it is up to them.

A request to fix it would be privately telling the maintainers about the issue. Publicly releasing it is a demand.

Re: FFmpeg to Google: Fund us or stop sending bugs

#485

Post by AnthonyMouse »

zdragnar wrote: post #421
deaddodo wrote: post #329

Earlier quoted context omitted.

And then the argument for refusing to just pay ffmpeg developers gets even more flimsy. The entire point here is to pay for the fixes/features you keep demanding, else the project is just going to do as it desires and ignore you. More and more OSS projects are getting to this point as large enterprises (especially in the SaaS/PaaS spheres) continue to take advantage of those projects and treat them like unpaid worker…

Not really. Their whole reason for not funding open source is it essentially funds their competitors who use the same projects. That's why they'd rather build a closed fork in-house than just hand money to ffmpeg. It's a dumb reason, especially when there are CVE bugs like this one, but that's how executives think.

> Their whole reason for not funding open source is it essentially funds their competitors who use the same projects. That's why they'd rather build a closed fork in-house than just hand money to ffmpeg.

So the premise here is that AWS should waste their own money maintaining an internal fork in order to try to make their competitors do the same thing? But then Google or Intel or someone just fixes it a bit later and wisely upstreams it so they can pay less than you by not maintaining an internal fork. Meanwhile you're still paying the money even though the public version has the fix because now you either need to keep maintaining your incompatible fork or pay again to switch back off of it. So what you've done is buy yourself a competitive disadvantage.

> that's how executives think.

That's how cargo cult executives think.

Just because you've seen someone else doing something doesn't mean you should do it. They might not be smarter than you.

Re: FFmpeg to Google: Fund us or stop sending bugs

#486

Post by tonymet »

Given the cost of discovering these issues, and the massive risk of exploitation, it’s likely that Google/Amazon/etc have them fixed in their private forks.

Fixing a private fork takes 1/5-1/10 the time of shepherding a PR to meet the maintainers expectations. And why spend 5x dev time to contribute fixes to your competitor?

Re: FFmpeg to Google: Fund us or stop sending bugs

#488

Post by rossjudson »

tpmoney wrote: post #431
firefax wrote: post #245

Is it unreasonable to ask that if a massive company funds someone to find a CVE in an open source project, they should also submit a patch? Google is a search company. Seems kind of... evil... to pay your devs to find holes in something with nothing to do with searching, then refuse to pay them to fix the problem they noticed.

Google contributes to ffmpeg on a fairly regular basis https://git.ffmpeg.org/gitweb/ffmpeg.git/search/HEAD?s=@goog... No it's not "unreasonable" to ask for patches along with bug fixes, but it is unreasonable to be mad if they don't. They could just not file the bug reports at all, and that is an objectively worse outcome.

Note that most open source contributions by Googlers are, as recommended by policy, done under their own personal accounts. There's a required registry internally mapping from their personal account to their @google.com identity.

The nice thing is that the open source contributions done by a Googler aren't necessarily tied to their Google identity.

Re: FFmpeg to Google: Fund us or stop sending bugs

#489

Post by pabs3 »

tpmoney wrote: post #424
bogwog wrote: post #93

Is it time for FFmpeg to relicense as AGPL? That'd be fun to witness.

To be clear, what does relicensing to AGPL do here? Does the AGPL include licensing terms that forbid filing bug reports without also including code patches? Or does it just make ffmpeg that much less appealing to projects and cut off the steady stream of contributions that it has gotten from google since 2009? https://git.ffmpeg.org/gitweb/ffmpeg.git/search/HEAD?pg=3;s=...

AGPL is banned from many BigCorps IIRC.

Re: FFmpeg to Google: Fund us or stop sending bugs

#490

Post by inkysigma »

themafia wrote: post #221
jeroenhd wrote: post #191

Earlier quoted context omitted.

> That does not impact their business or their operations in any way whatsoever. I don't know what tools and backends they use exactly, but working purely by statistics, I'm sure some place in Google's massive cloud compute empire is relying on ffmpeg to process data from the internet.

And they're processing old LucasArts codec videos with it? Which is the specific bug report in question.

It's unlikely the specific codec that is the issue but the bug report suggests that the code path could be hit by a maliciously crafted payload since ffmpeg does file fuzzing. They almost certainly have ffmpeg stuff that touches user submitted videos.
Post reply on HN