Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

761–770 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#761

Post by tpmoney »

Y-bar wrote: post #719
orangecat wrote: post #428

Earlier quoted context omitted.

Google did more than what is "strictly legal or required", and what they did was submit a good and valid bug report. But for some reason we're mad because they didn't do even more. Why? The Copenhagen Interpetation of Ethics is annoyingly prevalent ( https://forum.effectivealtruism.org/posts/QXpxioWSQcNuNnNTy/... )

"I noticed your window was broken, so I took the liberty of helping you, working for free, by posting a sign that says UNLOCKED WINDOW HERE with exact details on how it was broken. I did lots of gratis work for you which you do not need to do yourself now. The world is safer now. Why are you not grateful?"

I mean if we’re going to do sloppy analogies, a bug report for open source software as widely used as ffmpeg is more like “I noticed the trees in the back corner of your free apple orchard are producing apples with trace amounts of heavy metals. I did some literal digging and sent some soil off to the labs and it looks like your back corner field may be contaminated. Here’s a heads up about that, and also just FYI in 90 days, if you haven’t been able to get your soil remediated, I’m going to put up a sign so that people can know to avoid those apples and not get poisoned by your free orchard while it’s getting fixed.”

Re: FFmpeg to Google: Fund us or stop sending bugs

#762

Post by naasking »

vadansky wrote: post #35
Msurrow wrote: post #24

Earlier quoted context omitted.

My takeaway from the article was not that the report was a problem, but a change in approach from Google that they’d disclose publicly after X days, regardless of if the project had a chance to fix it. To me its okay to “demand” from a for profit company (eg google) to fix an issue fast. Because they have ressources. But to “demand” that an oss project fix something with a certain (possibly tight) timeframe.. well I’…

On the other hand as an ffmpeg user do you care? Are you okay not being told a tool you're using has a vulnerability in it because the devs don't have time to fix it? I mean someone could already be using the vulnerability regardless of what Google does.

> On the other hand as an ffmpeg user do you care? Are you okay not being told a tool you're using has a vulnerability in it because the devs don't have time to fix it?

Yes, because publicly disclosing the vulnerability means someone will have enough information to exploit it. Without public disclosure, the chance of that is much lower.

Re: FFmpeg to Google: Fund us or stop sending bugs

#763

Post by woodruffw »

gcr wrote: post #748
woodruffw wrote: post #249

Earlier quoted context omitted.

I don’t think vulnerability researchers are having trouble finding exploitable bugs in FFmpeg, so I don’t know how much this actually holds. Much of the cost center of vulnerability research is weaponization and making an exploit reliable against a specific set of targets. (The argument also seems backwards to me: Google appears to use a lot of not-inexpensive human talent to produce high quality reports to projects,…

Internally, Google maintains their own completely separate FFMpeg fork as well as a hardened sandbox for running that fork. Since they keep pace with releases to receive security fixes, there’s potentially lots of upstreamable work (with some effort on both sides…)

My understanding from adjacent threads in this discussion is that Google does in fact make significant upstream contributions to FFmpeg. Per policy those are often made with personal emails, but multiple people have said that Google’s investment in FFmpeg’s security and codec support have been significant.

(But also, while this is great, it doesn’t make an expectation of a patch with a security report reasonable! Most security reports don’t come with patches.)

Re: FFmpeg to Google: Fund us or stop sending bugs

#764

Post by bogwog »

tpmoney wrote: post #497
pabs3 wrote: post #489

Earlier quoted context omitted.

AGPL is banned from many BigCorps IIRC.

Right, but how is that a benefit here? The bug report was a valid report, ffmpeg is objectively better for it having been filed. Google contributes to ffmpeg on a regular basis according to the git history. They also buy consulting services from the ffmpeg maintainers according to the maintainer's own website. If ffmpeg was banned from Google, all of that would probably stop. So not only would ffmpeg have multiple un…

> To satisfy the unfocused and mistaken rage of the peanut gallery online?

That's only one possible benefit.

Another could be to gain leverage on big tech companies via dual licensing. If Google, Amazon, etc want to continue using FFmpeg without forking, they could do so by paying for the old LGPL license. It would likely be cheaper than maintaining a fork. They'd also have to release their changes anyways due to LGPL if they ever ship it client side.

So the incentive to contribute rather than fork would remain, and the only difference is that they have to pay a licensing fee.

Ofc this is probably just a fantasy. Relicensing FFmpeg like this probably isn't easy or possible.

Re: FFmpeg to Google: Fund us or stop sending bugs

#765

Post by walletdrainer »

rocqua wrote: post #739
walletdrainer wrote: post #623

Earlier quoted context omitted.

It’s possible that this is a more efficient use of their time when it comes to open source security as a whole, most projects do not have a problem with reports like this. If not pumping out patches allows them to get more security issues fixed, that’s fine!

From the perspective of Google maybe, but from the perspective of open source projects, how much does this drain them? Making open source code more secure and at the same time less prevalent seems like a net loss for society. And if those researchers could spare some time to write patches for open source projects, that might benefit society more than dropping disclosure deadlines on volunteers.

I’m specifically talking from the perspective of everybody but Google.

High quality bug reports like this are very good for open source projects.

Re: FFmpeg to Google: Fund us or stop sending bugs

#766

Post by mikkupikku »

monero-xmr wrote: post #576
fao_ wrote: post #323

Earlier quoted context omitted.

As yet, Valve is the only company I know of doing this, and it's paying off in dividends both for Linux and for Valve. In just 5ish years of Valve investing people and money into Linux- specifically mesa and WINE, Linux has gone from a product that is kind of shaky with Windows, to "I can throw a windows program or game at it and it usually works". Imagine how further the OSS ecosystem would be if Open Source hadn't…

Valve is so successful because it is a private company, and the CEO is the CTO and he is essentially the corporate equivalent of a religious monk. How else can you get 20+ years to slowly build a software business? As a side note YC and tech startups themselves have become reality TV. Your goal should be Valve! You should be Gabe Newell! You don’t need to be famous! Just build something valuable and be patient

Ironically, Gabe is more famous than the rest of whoever you're talking about, not because he seeks fame but just because he generally does right by his customers and makes himself accessible. Telling gamers to email him with questions, concerns, comments, anything, and then actually responding. Even though he's apparently spending most of his time hanging out on yachts, people love him because he makes an effort to be tuned in to what his customers want. If you do that, you'll be famous in a better way than what you can get from reality TV.

Re: FFmpeg to Google: Fund us or stop sending bugs

#767

Post by Y-bar »

tpmoney wrote: post #761
Y-bar wrote: post #719

Earlier quoted context omitted.

"I noticed your window was broken, so I took the liberty of helping you, working for free, by posting a sign that says UNLOCKED WINDOW HERE with exact details on how it was broken. I did lots of gratis work for you which you do not need to do yourself now. The world is safer now. Why are you not grateful?"

I mean if we’re going to do sloppy analogies, a bug report for open source software as widely used as ffmpeg is more like “I noticed the trees in the back corner of your free apple orchard are producing apples with trace amounts of heavy metals. I did some literal digging and sent some soil off to the labs and it looks like your back corner field may be contaminated. Here’s a heads up about that, and also just FYI in…

Yes, this is a good illustration why The Copenhagen Interpretation of Ethics makes sense when Ffmpeg is allowed to criticise the manner of actions of Google.

Re: FFmpeg to Google: Fund us or stop sending bugs

#768

Post by nradov »

red-iron-pine wrote: post #746
nradov wrote: post #471

Earlier quoted context omitted.

Check again. The Optum unit of UnitedHealth Group has huge revenue from software and technical services. If just that part of the business was spun out it would be one of the top 20 US tech companies.

too bad UnitedHealthGroup is capital-E Evil and is literally running the "death panels" that insane right wing propaganda tried to scare us about

What a lot of people don't realize is that it's mostly employer HR departments running the "death panels". UHG and its competitors would be happy to sell insurance policies that cover absolutely everything with no questions asked: this would be easier for them to administer without the hassles of utilization management and claim edits. But customers — mainly large employers — demand that insurers (or third-party administrators) impose more restrictive coverage rules in order to hold down medical costs.

Ultimately there will always be some healthcare rationing. This happens in every country. For example, the UK NHS has death panels which decide that certain treatments won't be covered at all because they're not cost effective. Resources are limited and demand is effectively infinite. So the only real question is how we do the rationing.

Re: FFmpeg to Google: Fund us or stop sending bugs

#769

Post by mikkupikku »

red-iron-pine wrote: post #743
monero-xmr wrote: post #576

Earlier quoted context omitted.

Valve is so successful because it is a private company, and the CEO is the CTO and he is essentially the corporate equivalent of a religious monk. How else can you get 20+ years to slowly build a software business? As a side note YC and tech startups themselves have become reality TV. Your goal should be Valve! You should be Gabe Newell! You don’t need to be famous! Just build something valuable and be patient

Steam is the most dominant game tool on the planet and landed when there was not yet a market for it. Very few other projects will get to the level of success it has in any sector, anywhere. GabeN was also a MS developer back in the day and likely would have been well off regardless, but he didn't need to play the YC A-B-let's-shoehorn-AI bullshit games that are 100% de rigeour for all startups in 2025.

From what I understand, Gabe/Valve almost went bust during Half Life's development. His gamble paid off when that turned into a runaway success, but he still could have lost it when he bet again on HL2 and Steam; at the time it was extremely controversial to make those a package deal. If Half Life 2 had been not quite as good as it turned out to be, it could have turned out to be a studio with a one hit wonder that burned their goodwill with some sketchy DRM sort of scheme on their second game.

Re: FFmpeg to Google: Fund us or stop sending bugs

#770

Post by NoGravitas »

GaryBluto wrote: post #589
Ferret7446 wrote: post #190

Earlier quoted context omitted.

So would you rather Google have a secure ffmpeg while us plebian individual users continue to have an insecure ffmpeg?

It's frustrating to me how many people are siding with FFmpeg here considering how unprofessional and generally asshole-ish they are being. I feel that this is mostly a kneejerk reaction to AI and Google in general, with people coming up with arguments to support their reaction after already forming an opinion.

It's a volunteer project, they have no requirement to be 'professional'. That's basically the root of the whole issue. A hobby project is not a product, and its developers are not vendors. Free software is not a supply chain.
Post reply on HN