Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

831–840 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#831

Post by Dylan16807 »

NoGravitas wrote: post #770
GaryBluto wrote: post #589

Earlier quoted context omitted.

It's frustrating to me how many people are siding with FFmpeg here considering how unprofessional and generally asshole-ish they are being. I feel that this is mostly a kneejerk reaction to AI and Google in general, with people coming up with arguments to support their reaction after already forming an opinion.

It's a volunteer project, they have no requirement to be 'professional'. That's basically the root of the whole issue. A hobby project is not a product, and its developers are not vendors. Free software is not a supply chain.

The word "unprofessional" here is muddying the comment more than it helps.

Let's just saying they're being asshole-ish, which is a problem for volunteer projects just as much as non-volunteer ones.

The ffmpeg twitter sucks.

Re: FFmpeg to Google: Fund us or stop sending bugs

#832

Post by Dylan16807 »

insane_dreamer wrote: post #821

> it is unreasonable for a trillion-dollar corporation like Google, which heavily relies on FFmpeg in its products, to shift the workload of fixing vulnerabilities to unpaid volunteers. They believe Google should either provide patches with vulnerability reports or directly support the project’s maintenance. This is so basic it shouldn't even have to be said.

The first part is technically true but doesn't apply to this situation. "Shift the workload"? This isn't google's bug, and google doesn't need it fixed. It was never their workload, and has not been shifted.

The last part is just wrong. Google does directly support the project's maintenance.

Re: FFmpeg to Google: Fund us or stop sending bugs

#833

Post by fph »

mrs6969 wrote: post #663
fph wrote: post #66

Earlier quoted context omitted.

If it's not free for enterprises then it's not open source, according to the commonly accepted definition.

Being open source and being free are entirely different things though. You can view, read the code = open source. The latter is about money.

Open source is not only about being able to read the code: the open source definition includes "Free Redistribution" (anyone who has the software can give away copies, and get paid if they want) and "No Discrimination Against Fields of Endeavor", among other requirements.

These two requirements combined make it impossible to distribute open source software with the provision that it is only free for individuals.

Re: FFmpeg to Google: Fund us or stop sending bugs

#834

Post by ndriscoll »

Dylan16807 wrote: post #827
ndriscoll wrote: post #778

Earlier quoted context omitted.

They're not deliberately infecting users with anything. There effectively saying "here's example code showing how to deal with these video formats. NOTE THAT THESE ARE EXAMPLES THAT I WROTE FOR FUN. THEY ARE NOT MEANT FOR SERIOUS USE AND MAY NOT HANDLE ALL CORNER CASES SAFELY. THIS SHOULD BE OBVIOUS SINCE WE HAVE NO COMMERCIAL RELATIONSHIP AND YOU'RE DOWNLOADING RANDOM CODE FROM SOMEONE YOU DON'T KNOW ON THE INTERNET…

They are not effectively saying that. The way they talk about the library everywhere else makes it clear that they do expect serious use. Disclaimers in the license don't override that, especially when 99% of software has a disclaimer like that. Those words are there for legal reasons only. If they wanted to market ffmpeg as a toy project only, not to be trusted, they could do that, but they are not doing that.

Except the very idea that they owe you anything is so absurd that even if they had a contract document stating that they'd do work for you, they still wouldn't have an obligation to do so because society has decided that contracts without some consideration from both sides are not valid. Similarly, even if something you buy comes with a piece of paper saying they don't owe you anything if it breaks, the law generally says that's not true. Because you paid for it.

But they don't say they warrant their work. They have a notice reminding you that you are receiving something for free, and that thing comes with no support, and is not meant to be fit for any particular use you might be thinking of, and that if you want support/help fulfilling some purpose, you can pay someone (maybe even them if you'd like) for that service. Because the way the world works is that as a general principle, other people don't owe you something for nothing. This is not just some legal mumbo jumbo. This is how life works for everyone. It's clear that they're not being malicious (they're not distributing a virus or something), and that's the most you can expect from them.

Computer security is always contextual, but as a general rule, if you're going to be accepting random input from unknown parties, you should have an expert that knows how to do that safely. And as mentioned elsewhere in these comments, such an expert would already be compiling out codecs they don't need and running the processing in a sandboxed environment to mitigate any issues. These days even software written in-house is run in sandboxed environments with minimal permissions when competent professionals are making things. That's just standard practice.

So they should be proud that they support obscure codecs, and by default the onus is on no one to ensure it's free from bugs. If an engineer needs to make a processing pipeline, the onus is always on them to do that correctly. If they want to use a free, unsupported hobby tool as part of their serious engineering project, it's on them to know how to manage any risks involved with that decision. Making good decisions here is literally their job.

Re: FFmpeg to Google: Fund us or stop sending bugs

#835

Post by Dylan16807 »

firefax wrote: post #814
tpmoney wrote: post #431

Earlier quoted context omitted.

Google contributes to ffmpeg on a fairly regular basis https://git.ffmpeg.org/gitweb/ffmpeg.git/search/HEAD?s=@goog... No it's not "unreasonable" to ask for patches along with bug fixes, but it is unreasonable to be mad if they don't. They could just not file the bug reports at all, and that is an objectively worse outcome.

>No it's not "unreasonable" to ask for patches along with bug fixes, but it is unreasonable to be mad if they don't Your stance seems to be is that it is unreasonable to be annoyed by someone who is being unreasonable. When I searched for synonyms for "unreasonable" in a major English language thesarus, the following synonyms were listed: indefensible, mindless, reasonless, senseless, unjustified, untenable, unwarran…

> Your stance seems to be is that it is unreasonable to be annoyed by someone who is being unreasonable.

No, that's not their stance.

You talked about whether ffmpeg was reasonable. They talked about whether ffmpeg was unreasonable.

You never accused google of being unreasonable, and they never mentioned it either.

So this idea of "responding to google being unreasonable" is a brand new premise. And I'm pretty sure they would disagree with that premise.

Re: FFmpeg to Google: Fund us or stop sending bugs

#837

Post by estimator7292 »

chanux wrote: post #794
Cthulhu_ wrote: post #692

Earlier quoted context omitted.

I think if you look a bit deeper, all product lines from said trillion dollor company rely on open source to some degree. They should be spending hundreds of millions in sponsorship of OS projects. They should put the maintainers on their payroll. Not even reporting to a manager, just pay them a salary for their OS work.

I have a feeling that if they do this, the economy would be hurt (somehow). None of us want the economy to be hurt, right?

That's what's going to happen when these corporations extract the last value from OSS and all the maintainers give up, so..

Re: FFmpeg to Google: Fund us or stop sending bugs

#838

Post by Dylan16807 »

ndriscoll wrote: post #834
Dylan16807 wrote: post #827

Earlier quoted context omitted.

They are not effectively saying that. The way they talk about the library everywhere else makes it clear that they do expect serious use. Disclaimers in the license don't override that, especially when 99% of software has a disclaimer like that. Those words are there for legal reasons only. If they wanted to market ffmpeg as a toy project only, not to be trusted, they could do that, but they are not doing that.

Except the very idea that they owe you anything is so absurd that even if they had a contract document stating that they'd do work for you, they still wouldn't have an obligation to do so because society has decided that contracts without some consideration from both sides are not valid. Similarly, even if something you buy comes with a piece of paper saying they don't owe you anything if it breaks, the law generally…

> the very idea that they owe you anything

All I'm asking for right here is consistency about whether the library is mostly secure. The ethical requirement is to follow through on your claims and implications, while making claims and implications is completely optional.

> Computer security is always contextual, but as a general rule, if you're going to be accepting random input from unknown parties, you should have an expert that knows how to do that safely. And as mentioned elsewhere in these comments, such an expert would already be compiling out codecs they don't need and running the processing in a sandboxed environment to mitigate any issues.

Sandboxing is great defense in depth but most software should not require sandboxing. And expecting everyone to have an expert tweaking compilation is not realistic. Defaults matter, and security expectations need to be established between the site, the documentation, and the defaults, not left as a footgun for only experts to avoid.

Re: FFmpeg to Google: Fund us or stop sending bugs

#839

Post by firefax »

Dylan16807 wrote: post #835
firefax wrote: post #814

Earlier quoted context omitted.

>No it's not "unreasonable" to ask for patches along with bug fixes, but it is unreasonable to be mad if they don't Your stance seems to be is that it is unreasonable to be annoyed by someone who is being unreasonable. When I searched for synonyms for "unreasonable" in a major English language thesarus, the following synonyms were listed: indefensible, mindless, reasonless, senseless, unjustified, untenable, unwarran…

> Your stance seems to be is that it is unreasonable to be annoyed by someone who is being unreasonable. No, that's not their stance. You talked about whether ffmpeg was reasonable. They talked about whether ffmpeg was unreasonable. You never accused google of being unreasonable, and they never mentioned it either. So this idea of "responding to google being unreasonable" is a brand new premise. And I'm pretty sure t…

Are you on the autistic spectrum and/or not a native speaker of English? If we are discussing if FFMPEG's stance is reasonable, then it follows we are discussing of Google's actions are unreasonable.

Google is absolutely being unreasonable here -- they should instruct their engineers to submit a patch when submitting CVEs, and FFMPEG is perfectly valid to engage in a little activism to nudge them along.

Re: FFmpeg to Google: Fund us or stop sending bugs

#840

Post by Dylan16807 »

firefax wrote: post #839
Dylan16807 wrote: post #835

Earlier quoted context omitted.

> Your stance seems to be is that it is unreasonable to be annoyed by someone who is being unreasonable. No, that's not their stance. You talked about whether ffmpeg was reasonable. They talked about whether ffmpeg was unreasonable. You never accused google of being unreasonable, and they never mentioned it either. So this idea of "responding to google being unreasonable" is a brand new premise. And I'm pretty sure t…

Are you on the autistic spectrum and/or not a native speaker of English? If we are discussing if FFMPEG's stance is reasonable, then it follows we are discussing of Google's actions are unreasonable. Google is absolutely being unreasonable here -- they should instruct their engineers to submit a patch when submitting CVEs, and FFMPEG is perfectly valid to engage in a little activism to nudge them along.

> [...]then it follows we are discussing[...]

It's all connected but... Here, I'll phrase it more simply:

They didn't agree that google is being unreasonable. You are not interpreting them right.

I don't care how confident you are that google is being unreasonable. The "your stance seems to be" statement in your previous comment is wrong.

Post reply on HN