Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

651–660 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#651

Post by [deleted] »

Msurrow wrote: post #24
woodruffw wrote: post #10

I’m an open source maintainer, so I empathize with the sentiment that large companies appear to produce labor for unpaid maintainers by disclosing security issues. But appearance is operative: a security issue is something that I (as the maintainer) would need to fix regardless of who reports it, or would otherwise need to accept the reputational hit that comes with not triaging security reports. That’s sometimes per…

My takeaway from the article was not that the report was a problem, but a change in approach from Google that they’d disclose publicly after X days, regardless of if the project had a chance to fix it. To me its okay to “demand” from a for profit company (eg google) to fix an issue fast. Because they have ressources. But to “demand” that an oss project fix something with a certain (possibly tight) timeframe.. well I’…

[deleted]

Re: FFmpeg to Google: Fund us or stop sending bugs

#652

Post by Dylan16807 »

HDThoreaun wrote: post #533
saagarjha wrote: post #513

Earlier quoted context omitted.

This is not how filing issues against open source software works.

You dont get to decide that lmao. Telling everyone this project doesnt care about security if they ignore my CVE is obviously a demand and your traditions can not change that

> Telling everyone this project doesnt care about security

Google did nothing like this.

If people infer that a hypothetical project doesn't care about security because they didn't fix anything, then they're right. It's not google's fault they're factually bad at security. Making someone look bad is not always a bad action.

Drawing attention to that decision by publicly reporting a bug is not a demand for what the decision will be. I could imagine malicious attention-getting but a bug report isn't it.

Re: FFmpeg to Google: Fund us or stop sending bugs

#653

Post by josephg »

cornonthecobra wrote: post #361
skhameneh wrote: post #264

Earlier quoted context omitted.

I've been a proponent of upstreaming fixes for open source software. Why? - It makes continued downstream consumption easier, you don't have to rely on fragile secret patches. - It gives back to projects that helped you to begin with, it's a simple form of paying it forward. - It all around seems like the "ethical" and "correct" thing to do. Unfortunately, in my experience, there's often a lot of barriers within comp…

I've literally had my employer's attorneys tell me I can't upstream patches because it would put my employer's name on the project, and they don't want the liability. No, it didn't help giving them copies of licenses that have the usual liability clauses. It seems a lot of corporate lawyers fundamentally misunderstand open source.

I don't know if it would work, but sometimes I consider a "moochers" rule wrt opensource code.

Like, here's the deal: The work is proper, legit opensource. You can use it for free, with no obligations.

But if your company makes a profit from it, you're expected to either donate money to the project or contribute code back in kind. (Eg security patches, bug fixes, or contribute your own opensource projects to the ecosystem, etc).

If you don't, all issues you raise and PRs get tagged with a special "moocher" status. They're automatically - by default - ignored or put in a low priority bin. If your employees attend any events, or join a community discord or anything like that, you get a "moocher" badge, so everyone can see that you're a parasite or you work for parasites. Thats ok; opensource licenses explicitly allow parasites. I'm sure you're a nice person. But we don't really welcome parasites in our social spaces, or allow parasites to take up extra time from the developers.

Re: FFmpeg to Google: Fund us or stop sending bugs

#654

Post by surajrmal »

watwut wrote: post #607
KingMob wrote: post #547

Earlier quoted context omitted.

> It’s starting to feel silly to demonize Google for doing security research at this point. Aren't most people here demonizing Google for dedicating the resources to find bugs, but not to fix them?

And not giving the maintainners reasonable amount of time to fix. This was triggered by recent change of policy on google side.

The timeline is industry standard at this point. The point is make sure folks take security more seriously. If you start deviating from the script, others will expect the same exceptions and it would lose that ability. Sometimes it's good to let something fail loudly to show this is a problem. If ffmpeg doesn't have enough maintainers, then they should fail and let downstream customers know so they have more pressure to contribute resources. Playing superman and trying to prevent them from seeing the problem will just lead to burn out.

Re: FFmpeg to Google: Fund us or stop sending bugs

#655

Post by saagarjha »

adastra22 wrote: post #604
saagarjha wrote: post #515

Earlier quoted context omitted.

You are welcome to view the report however you like, but a world where an easily reproducible OOB read and UAF in the default configuration is an "unexploitable non-issue" is not reality.

For a codec that isn't configured by default, and only used and maintained by a hobbyist video game content preservation group. Yeah it's a non-issue.

It's used by exploit authors, too.

Re: FFmpeg to Google: Fund us or stop sending bugs

#656

Post by surajrmal »

samus wrote: post #587
woodruffw wrote: post #10

I’m an open source maintainer, so I empathize with the sentiment that large companies appear to produce labor for unpaid maintainers by disclosing security issues. But appearance is operative: a security issue is something that I (as the maintainer) would need to fix regardless of who reports it, or would otherwise need to accept the reputational hit that comes with not triaging security reports. That’s sometimes per…

So what is Google gonna do if security fixes don't happen in time and the project takes a "reputational hit"? Fork it and maintain it themselves? Why not send in patches instead? Maintaining a reputation might be enough reward for you, but not everyone is happy to work for free for a billion dollars corporation breathing down their necks. It's puzzling to me why people keep defending their free lunch.

If ffmpeg maintainers cannot keep up, downstream customers should know so they can help.

Re: FFmpeg to Google: Fund us or stop sending bugs

#657

Post by saagarjha »

walletdrainer wrote: post #641
saagarjha wrote: post #445

Earlier quoted context omitted.

If they are unable to fix CVEs in a timely manner, then it is very reasonable for people to judge them (accurately!) as being unable to fix CVEs in a timely manner. Maybe some people might even decide to use other projects or chip in to help out! However, it is dishonest to hide reports and pretend like bugs are being fixed on time when they are not.

Please don’t use “CVE” as a stand-in for “vulnerability”, you know much better than this :) Most vulnerabilities never get CVEs even when they’re patched.

Only using it because the comment I replied to is, of course I agree that most vulnerabilities are patched without one

Re: FFmpeg to Google: Fund us or stop sending bugs

#658

Post by Dylan16807 »

Yokolos wrote: post #229
woodruffw wrote: post #10

I’m an open source maintainer, so I empathize with the sentiment that large companies appear to produce labor for unpaid maintainers by disclosing security issues. But appearance is operative: a security issue is something that I (as the maintainer) would need to fix regardless of who reports it, or would otherwise need to accept the reputational hit that comes with not triaging security reports. That’s sometimes per…

I see you didn't read the article. The problem isn't Google reporting vulnerabilities. It's Google using AI to find obscure bugs that affect 2 people on the planet, then making a CVE out of it, without putting any effort into fixing it themselves or funding the project. What are the ffmpeg maintainers supposed to do about this? It's a complete waste of everybody's time. > The latest episode was sparked after a Google…

> that affect 2 people on the planet

Wrong. The original files only affect 2 people. A malicious file could be anywhere.

Do you remember when certain sequences of letters could crash iphones? The solution was not "only two people are likely to ever type that, minimum priority". Because people started spreading it on purpose.

Re: FFmpeg to Google: Fund us or stop sending bugs

#659

Post by saagarjha »

HDThoreaun wrote: post #533
saagarjha wrote: post #513

Earlier quoted context omitted.

This is not how filing issues against open source software works.

You dont get to decide that lmao. Telling everyone this project doesnt care about security if they ignore my CVE is obviously a demand and your traditions can not change that

If the FFmpeg team does not want people to file bug reports, then they should close their public issue tracker. This is not something that I decided but a choice that they made.

Re: FFmpeg to Google: Fund us or stop sending bugs

#660

Post by kierank »

surajrmal wrote: post #656
samus wrote: post #587

Earlier quoted context omitted.

So what is Google gonna do if security fixes don't happen in time and the project takes a "reputational hit"? Fork it and maintain it themselves? Why not send in patches instead? Maintaining a reputation might be enough reward for you, but not everyone is happy to work for free for a billion dollars corporation breathing down their necks. It's puzzling to me why people keep defending their free lunch.

If ffmpeg maintainers cannot keep up, downstream customers should know so they can help.

FFmpeg is developed almost entirely by volunteers. We have no "customers".
Post reply on HN