Most active commenters
  • StopDisinfo910(3)

←back to thread

FFmpeg to Google: Fund us or stop sending bugs

(thenewstack.io)
1125 points CrankyBear | 11 comments | 11 Nov 25 18:32 UTC | HN request time: 0.01s | source | bottom
Show context
ganelonhb ◴[11 Nov 25 19:14 UTC] No.45891485[source]▶
Not too fond of maintainers getting too uppity about this stuff. I get that it can be frustrating to receive bug report after bug report from people who are unwilling or unable to contribute to the code base, or at the very least to donate to the team.

But the way I see it, a bug report is a bug report, no matter how small or big the bug or the team, it should be addressed.

I don’t know, I’m not exactly a pillar of the FOSS community with weight behind my words.

replies(4): >>45891536 #>>45891550 #>>45891599 #>>45900858 #
1. StopDisinfo910 ◴[11 Nov 25 19:17 UTC] No.45891550[source]▶
It’s not bug reports. It’s CVE.

There is a convergence of very annoying trends happening: more and more are garbage found and written using AI and with an impact which is questionable at best, the way CVE are published and classified is idiotic and platform founding vulnerability research like Google are more and more hostile to projects leaving very little time to actually work on fixes before publishing.

This is leading to more and more open source developers throwing the towel.

replies(2): >>45891594 #>>45891671 #
2. ranger_danger ◴[11 Nov 25 19:21 UTC] No.45891594[source]▶
CVEs aren't caused by bugs?
replies(3): >>45891838 #>>45892303 #>>45898318 #
3. ikiris ◴[11 Nov 25 19:25 UTC] No.45891671[source]▶
The lowered lead times are because devs have an entitled additude that others fix their code when they discover bugs in it.

The 90 day period is the grace period for the dev, not a demand. If they don't want to fix it then it goes public.

replies(2): >>45891811 #>>45892063 #
4. ivell ◴[11 Nov 25 19:39 UTC] No.45891811[source]▶
It is super strange to say that who devoted their time and effort and then gives away their work for free is somehow entitled.

If this keeps up, there won't be anyone willing to maintain the software due to burn out.

In today's situation, free software is keeping many companies honest. Losing that kind of leverage would be a loss to the society overall.

And the public disclosure is going to hurt the users which could include defense, banks and other critical institutions.

5. kykat ◴[11 Nov 25 19:42 UTC] No.45891838[source]▶
You could argue that, but I think that a bug is the software failing to do what it was specified, or what it promised to do. If security wasn't promised, it's not a bug.
replies(1): >>45892086 #
6. adastra22 ◴[11 Nov 25 20:01 UTC] No.45892063[source]▶
> The lowered lead times are because devs have an entitled additude that others fix their code when they discover bugs in it.

That’s how open source works.

7. adastra22 ◴[11 Nov 25 20:03 UTC] No.45892086{3}[source]▶
Which is exactly the case here. This CVE is for a hobby codec written to support digital preservation of a some obscure video files from the 90’s that are used nowhere else. No security was promised.
8. StopDisinfo910 ◴[11 Nov 25 20:20 UTC] No.45892303[source]▶
They are not published in project bug trackers and are managed completely differently so no, personally, I don't view CVE as bug reports. Also, please, don't distrort what I say and omit part of my comment, thank you.

Some of them are not even bugs in the traditional sense of the world but expected behaviours which can lead to unsecure side effects.

replies(1): >>45892566 #
9. jsnell ◴[11 Nov 25 20:44 UTC] No.45892566{3}[source]▶
It seems like you might misunderstand what CVEs are? They're just identifiers.

This was a bug, which caused an exploitable security vulnerability. The bug was reported to ffmpeg, over their preferred method for being notified about vulnerabilities in the software they maintain. Once ffmpeg fixed the bug, a CVE number was issued for the purpose of tracking (e.g. which versions are vulnerable, which were never vulnerable, which have a fix).

Having a CVE identifier is important because we can't just talk about "the ffmpeg vulnerability" when there have been a dozen this year, each with different attack surfaces. But it really is just an arbitrary number, while the bug is the actual problem.

replies(1): >>45892900 #
10. StopDisinfo910 ◴[11 Nov 25 21:10 UTC] No.45892900{4}[source]▶
I'm not misunderstanding anything. CVE involves a third party and it's not just a number. It's a number and an evaluation of severity.

Things which are usually managed inside a project now have a visibility outside of it. You might justify it as you want like the need to have an identifier. It doesn't fundamentally change how that impacts the dynamic.

Also, the discussion is not about a specific bug. It's a general discussion regarding how Google handles disclosure in the general case.

11. walletdrainer ◴[12 Nov 25 09:59 UTC] No.45898318[source]▶
Not always, there have been a plenty of CVEs issued for completely absurd reasons.