Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

721–730 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#721

Post by mrkiouak »

andriamanitra wrote: post #720

As much as I hate to be on Google's side I think they're doing a reasonable thing here. Valid bug reports are valuable contributions on their own, and disclosing security issues is standard practice. Not disclosing them doesn't help anyone. Security through obscurity is not security. If neither FFMPEG nor Google dedicate resources to fixing the issue in 90 days, making it public at least ensures that it gets visibili…

As someone who worked as a software engineer at Google on a service that heavily depended on FFmpeg, its absurd that Google posts security bugs (which have the obvious potential outcome of driving more free work) vs just paying an engineer to fix the bug.

I promise they are spending more on extra compute for resiliency and redundancy for FFMPEG issues than it would cost for a single SWE to just write a fix and then shepherd through the FFmpeg approval process.

Re: FFmpeg to Google: Fund us or stop sending bugs

#722

Post by fukka42 »

WesolyKubeczek wrote: post #701
josephg wrote: post #648

Earlier quoted context omitted.

Maybe, it depends! Maybe the developer intends to some day change the internal implementation, such that that particular boolean flag wouldn't make sense any more. Or they're considering taking out the option entirely, and thus simplifying the codebase by making it so it only works one way. Maybe the developer just doesn't care about your use case. If I have a project that works fine for what I do with it, why should…

I don't know. The pattern I have seen is that if you want to contribute a fix into a project, you are expected to "engage with the community", wear their badge, invest into the whole thing. I don't want to be in your community, I want to fix a bug in a thing I'm using and go on with my life. Given the usual dynamics of online communities which are getting somehow increasingly more prone to dramas, toxicity, tribalism…

Being allowed to contribute to open source is a privilege, not a right.

You could also just pay for it.

Re: FFmpeg to Google: Fund us or stop sending bugs

#723

Post by Propelloni »

codeptualize wrote: post #706

I think the glaring issue underlying this is that the big companies are not investing enough in the tools they rely on. I agree with some of the arguments that patching up vulnerabilities is important, but it's crazy to put that expectation on unpaid volunteers when you flood them with CVE's some completely irrelevant. Also the solution is fairly simple: Either, you submit a PR instead of an issue. Or, you send a gen…

The solution is even simpler. The project puts the bug report in its triage backlog. It works through it in its own time, and decides on severity and priority. That's the time-honored method.

The compounding factor here is the automated reporting and disclosure process of Google's Project Zero. GPZ automatically discloses bugs after 90 days. Even if Google does not expect bugs to be fixed within this period, the FFmpeg devs clearly feel pressure.

But it is an open source project, basically a hobby for most devs. Why accept pressure at all? Continue to proceed in the time-honored method. If and when Youtube explodes because of a FFmpeg bug, Google has only itself to blame. They could have done something but decided to freeload.

I really don't see the issue.

Re: FFmpeg to Google: Fund us or stop sending bugs

#725

Post by mrkiouak »

mrkiouak wrote: post #721
andriamanitra wrote: post #720

As much as I hate to be on Google's side I think they're doing a reasonable thing here. Valid bug reports are valuable contributions on their own, and disclosing security issues is standard practice. Not disclosing them doesn't help anyone. Security through obscurity is not security. If neither FFMPEG nor Google dedicate resources to fixing the issue in 90 days, making it public at least ensures that it gets visibili…

As someone who worked as a software engineer at Google on a service that heavily depended on FFmpeg, its absurd that Google posts security bugs (which have the obvious potential outcome of driving more free work) vs just paying an engineer to fix the bug. I promise they are spending more on extra compute for resiliency and redundancy for FFMPEG issues than it would cost for a single SWE to just write a fix and then s…

Bonus comment: I was present for conversations about how Google should just write an internal version because of all the stability issues, but that that work would never get prioritized or be considered valuable because it wouldn't get anyone promoted (to be fair, given how widely FFmpeg is used, it would have gotten an L4 or L5 promoted, but it would have been a near sisyphean task over years to get to the point where you could demostrate the ridiculously high XXm-XXXm returns that would come from just helping to improve FFmpeg).

Re: FFmpeg to Google: Fund us or stop sending bugs

#726

Post by fukka42 »

Cthulhu_ wrote: post #690
cornonthecobra wrote: post #361

Earlier quoted context omitted.

I've literally had my employer's attorneys tell me I can't upstream patches because it would put my employer's name on the project, and they don't want the liability. No, it didn't help giving them copies of licenses that have the usual liability clauses. It seems a lot of corporate lawyers fundamentally misunderstand open source.

It goes even further sometimes, I've seen someone in the Go community slack announce they are going to dial back their activity because of Very Serious Clauses in their Apple contract. That seems to imply that Apple employees are prohibited from being good internet citizens and e.g. helping people out with any kind of software issue. This presumably includes contributing to open source, although I'm sure they can get…

Apple? Not interested in being a good internet citizen? Say it ain't so!

Re: FFmpeg to Google: Fund us or stop sending bugs

#727

Post by raincole »

AbrahamParangi wrote: post #68
woodruffw wrote: post #10

I’m an open source maintainer, so I empathize with the sentiment that large companies appear to produce labor for unpaid maintainers by disclosing security issues. But appearance is operative: a security issue is something that I (as the maintainer) would need to fix regardless of who reports it, or would otherwise need to accept the reputational hit that comes with not triaging security reports. That’s sometimes per…

If google bears no role in fixing the issues it finds and nobody else is being paid to do it either, it functionally is just providing free security vulnerability research for malicious actors because almost nobody can take over or switch off of ffmpeg.

Security by obscurity. In 2025. On HN.

Re: FFmpeg to Google: Fund us or stop sending bugs

#728

Post by raincole »

Aurornis wrote: post #520
profsummergig wrote: post #511

Earlier quoted context omitted.

[flagged]

Anyone comparing normal adulthood stuff to slavery needs to spend some time reading some history books.

Anyone who actually read some history books would know slavery was considered "normal stuff" until it wasn't.

Re: FFmpeg to Google: Fund us or stop sending bugs

#729

Post by UncleMeat »

degamad wrote: post #548
fulafel wrote: post #456

Earlier quoted context omitted.

It's neither. WP says: > After finding a number of flaws in software used by many end-users while researching other problems, such as the critical "Heartbleed" vulnerability, Google decided to form a full-time team dedicated to finding such vulnerabilities, not only in Google software but any software used by its users.

It did that but it did not decide to form a team dedicated to fixing issues in software that it uses? That's the misallocation of funds that's at play here. The ideal outcome is that Project Zero sends its discoveries off to a team who triage and develop patches for the significant vulnerabilities, and then the communication with the project is a much more helpful one.

The security and privacy org is much large than just GPZ, but the security and privacy org does not have a general remit to fix all vulns everywhere. GPZ is also not the only part of the org that finds bugs in open source software but is not generally obligated to fix them. Projects like ossfuzz are similar.

Google could staff a team that is responsible for remediating vulns in open source software that doesn't actually affect any of Google's products. Lord knows they've got enough money. I'd prefer it if they did that. But I don't really see the reasoning behind why they must do this or scrap all vuln research on open source software.

Re: FFmpeg to Google: Fund us or stop sending bugs

#730

Post by roryirvine »

ezconnect wrote: post #675
7e wrote: post #461

Earlier quoted context omitted.

Those aren’t tech giants. They're just shit companies. I agree they greatly outnumber Big Tech, in employees if not talent.

Walmart is a tech giant.

FWIW, when working at a major Silicon Valley tech company in the mid 2010s, my team made significant contributions to OSS projects including OpenStack and the Linux kernel as a core part of our work for Walmart.

The work to upstream our changes was included in the Statements of Work which Walmart signed off on, and our time spent on those efforts was billed to them.

The stats for those projects will have recorded my former employer as the direct source of those contributions - but they wouldn't have existed had it not been for Walmart.

Post reply on HN