←back to thread

FFmpeg to Google: Fund us or stop sending bugs

(thenewstack.io)
1125 points CrankyBear | 1 comments | 11 Nov 25 18:32 UTC | HN request time: 0.219s | source
Show context
pjmlp ◴[11 Nov 25 19:43 UTC] No.45891849[source]▶
Fully on FFmpeg team side, many companies approach to FOSS is only doing so when it sounds good on their marketing karma, leech otherwise.

Most of them would just pirate in the old days, and most FOSS licences give them clear conscience to behave as always.

replies(2): >>45892276 #>>45892516 #
iscoelho ◴[11 Nov 25 20:39 UTC] No.45892516[source]▶
Google is, at no cost to FFMPEG:

1) dedicating compute resources to continuously fuzzing the entire project

2) dedicating engineering resources to validating the results and creating accurate and well-informed bug reports (in this case, a seriously underestimated security issue)

3) additionally for codecs that Google likely does not even internally use or compile, purely for the greater good of FFMPEG's user base

Needless to say, while I agree Google has a penny to spare to fund FFMPEG, and should (although they already contribute), I do not agree with funding this maintainer.

replies(3): >>45892589 #>>45892848 #>>45895277 #
pjmlp ◴[11 Nov 25 20:47 UTC] No.45892589[source]▶
Then they can surely also provide a pull request for said CVE.
replies(2): >>45892622 #>>45893197 #
SR2Z ◴[11 Nov 25 20:48 UTC] No.45892622[source]▶
Where do you draw the line? Do you want Google to just not inspect any projects that it can't fully commit to maintaining?

Providing a real CVE is a contribution, not a burden. The ffmpeg folks can ignore it, since by all indications it's pretty minor.

replies(4): >>45892822 #>>45892859 #>>45893344 #>>45893509 #
strictnein ◴[11 Nov 25 21:04 UTC] No.45892822[source]▶
Personally, I want the $3.5 Trillion company to do more. So the line should be somewhere else.
replies(1): >>45893987 #
SR2Z ◴[11 Nov 25 22:50 UTC] No.45893987[source]▶
So you don't have a line, you just want to move the goalposts and keep moving them?
replies(2): >>45895481 #>>45896323 #
1. iscoelho ◴[12 Nov 25 01:51 UTC] No.45895481[source]▶
It is my understanding that the commenters in FFMPEG's favor believe that Google is doing a disservice by finding these security vulnerabilities, as they require volunteer burden to patch, and that they should either:

1) allow the vulnerabilities to remain undiscovered & unpatched zero-days (stop submitting "slop" CVEs.)

2) supply the patches (which i'm sure the goalpost will move to the maintainers being upset that they have to merge them.)

3) fund the project (including the maintainers who clearly misunderstand the severity of the vulnerabilities and describe them as "slop") (no thank you.)

This entire thread defies logic.