Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

711–720 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#711

Post by seb1204 »

inkysigma wrote: post #301
Yokolos wrote: post #229

Earlier quoted context omitted.

I see you didn't read the article. The problem isn't Google reporting vulnerabilities. It's Google using AI to find obscure bugs that affect 2 people on the planet, then making a CVE out of it, without putting any effort into fixing it themselves or funding the project. What are the ffmpeg maintainers supposed to do about this? It's a complete waste of everybody's time. > The latest episode was sparked after a Google…

I don't think that's an accurate description of the full scope of the problem. The codec itself is mostly unused but the code path can possibly be triggered from file fuzzing that ffmpeg uses so a maliciously crafted payload (e.g. any run of ffmpeg that touches user input without disabling this codec) could possibly be exploited.

Why does google simply build their own ffmpeg from source without the codec?

Re: FFmpeg to Google: Fund us or stop sending bugs

#712

Post by seb1204 »

kierank wrote: post #660
surajrmal wrote: post #656

Earlier quoted context omitted.

If ffmpeg maintainers cannot keep up, downstream customers should know so they can help.

FFmpeg is developed almost entirely by volunteers. We have no "customers".

Why complain about pressure from customers then?

Re: FFmpeg to Google: Fund us or stop sending bugs

#713

Post by necovek »

tpmoney wrote: post #574
necovek wrote: post #543

Earlier quoted context omitted.

It's funny you come up with that suggestion when I clearly offer a different solution: "make your internal teams do the right thing by both reporting, but also helping fix the issue with hands-on work". It's a call not to stop reporting, but to equally invest in fixing these.

Hands on work like filing a detailed bug report with suspected line numbers, reproduction code and likely causes? Look, I get it. It would be nice if Google had filed a patch with the bug. But also not every bug report is going to get a patch with it, nor should that be the sort of expectation we have. It's hard enough getting corporations to contribute time and resources to open source projects as it is, to set an e…

And if they choose 2), would they stop to consider what happens if everybody does that? What's their fallback plan once maintainers dump the project?

All I am saying is that you should be as mindful to open source maintainers as you are to the people at companies.

Re: FFmpeg to Google: Fund us or stop sending bugs

#714

Post by seb1204 »

saagarjha wrote: post #445
lenerdenator wrote: post #284

Earlier quoted context omitted.

They aren't obligated to fix CVEs until they're exploited, and then, suddenly, they very much were obligated to fix the CVEs, and their image as FLOSS maintainers and as a project are very much tarnished.

If they are unable to fix CVEs in a timely manner, then it is very reasonable for people to judge them (accurately!) as being unable to fix CVEs in a timely manner. Maybe some people might even decide to use other projects or chip in to help out! However, it is dishonest to hide reports and pretend like bugs are being fixed on time when they are not.

I would like them to publicly state that there are not enough hours in their day to fix this, therefore it will have to wait until they get to it.

Re: FFmpeg to Google: Fund us or stop sending bugs

#715

Post by woodruffw »

Orygin wrote: post #689
woodruffw wrote: post #530

Earlier quoted context omitted.

This isn’t true at all in my experience: disclosures happen on a timeline (60 to 90 days is common), with extensions provided as a courtesy based on remediation complexity and other case-by-case considerations. I’ve been party to plenty of advisories that went public without a fix because the upstream wasn’t interested in providing one.

For OSS projects or commercial ones? I feel it's not the same when one has trillion in market cap and the other has a few unpaid maintainers.

The norm is the same for both. Perhaps there’s an argument that it should be longer for OSS maintainers, but OSS maintainers also have different levers at their disposal: they can just say “no, I don’t care” because nobody’s paying them. A company can’t do that, at least not without a financial hit.

To my original comment, the underlying problem here IMO is wanting to have it both ways: you can adhere to common notions of security for reputational reasons, or you can exercise your right as a maintainer to say “I don’t care,” but you can’t do both.

Re: FFmpeg to Google: Fund us or stop sending bugs

#716

Post by seb1204 »

vacuity wrote: post #411
nightshift1 wrote: post #331

Earlier quoted context omitted.

I don't think anyone can force them to fix cve. Software is provided as-is. Can't be more straightforward as that.

This is technically true, but not plausible in the social sense.

Why not. I can't force you to do your volunteering work.

Re: FFmpeg to Google: Fund us or stop sending bugs

#717

Post by seb1204 »

jitbit wrote: post #684
woodruffw wrote: post #10

I’m an open source maintainer, so I empathize with the sentiment that large companies appear to produce labor for unpaid maintainers by disclosing security issues. But appearance is operative: a security issue is something that I (as the maintainer) would need to fix regardless of who reports it, or would otherwise need to accept the reputational hit that comes with not triaging security reports. That’s sometimes per…

True - if we're talking about actual security bugs, not the "CVE slop" P.S. I'm an open source maintainer myself, and I used to think, "oh, OSS developers should just stop whining and fix stuff." Fast forward a few years, and now I'm buried under false-positive "reports" and overwhelmed by non-coding work (deleting issue spam, triage, etc.) P.P.S. What's worse, when your library is a security component the pressure’s…

Please speak openly about that on your dev page Manage expectations.

Re: FFmpeg to Google: Fund us or stop sending bugs

#718

Post by Y-bar »

gnfargbl wrote: post #643
Y-bar wrote: post #324

Earlier quoted context omitted.

> They could, but there is really no requirement on them to do so. I see this sort of sentiment daily. The sentiment that only what is strictly legal or required is what matters. Sometimes, you know, you have to recognise that there are social norms and being a good person matters and has intrinsic value. A society only governed by what the written law of the land explicitly states is a dystopia worse than hell.

You're correct, but it's the social norms -- or at least, the norms as I perceive them -- that I am talking about here. If you find yourself with potentially serious security bugs in your repo, then the social norm should be for you to take ownership of that because, well, it's your repo. The socially unacceptable activity here should be treating security issues as an irritation, or a problem outside your control. If…

It seems to me that they are not treating the security issue as an irritation, but instead the manner at which it was presented to them that is the problem.

Re: FFmpeg to Google: Fund us or stop sending bugs

#719

Post by Y-bar »

orangecat wrote: post #428
tpmoney wrote: post #373

Earlier quoted context omitted.

What's "strictly legal or required" of Google here is absolutely nothing. They didn't have to do any auditing or bug hunting. They certainly didn't have to validate or create a proper bug report, and there's no requirement whatsoever that they tell anyone about it at all. They could have found the bug, found it was being actively exploited, made their own internal patch and sat quietly by while other people remained…

Google did more than what is "strictly legal or required", and what they did was submit a good and valid bug report. But for some reason we're mad because they didn't do even more. Why? The Copenhagen Interpetation of Ethics is annoyingly prevalent ( https://forum.effectivealtruism.org/posts/QXpxioWSQcNuNnNTy/... )

"I noticed your window was broken, so I took the liberty of helping you, working for free, by posting a sign that says UNLOCKED WINDOW HERE with exact details on how it was broken. I did lots of gratis work for you which you do not need to do yourself now. The world is safer now. Why are you not grateful?"

Re: FFmpeg to Google: Fund us or stop sending bugs

#720

Post by andriamanitra »

As much as I hate to be on Google's side I think they're doing a reasonable thing here. Valid bug reports are valuable contributions on their own, and disclosing security issues is standard practice. Not disclosing them doesn't help anyone. Security through obscurity is not security. If neither FFMPEG nor Google dedicate resources to fixing the issue in 90 days, making it public at least ensures that it gets visibility and thus has a higher chance to get fixed by a third party.

I'm sure Google could (and probably should) do even more to help, but FFMPEG directing social media rage at a company for contributing to their project is a bone-headed move. There are countless non-Google companies relying on FFMPEG that do much less for the project, and a shit show like this is certainly not going to encourage them to get involved.

Post reply on HN