3 ms·
Unless you're a broadcast studio, aren't most videos client-encoded one way or another? Does YouTube even let users upload raw, uncompressed video? Speaking of
by wahern 6y ago
Unless you're a broadcast studio, aren't most videos client-encoded one way or another? Does YouTube even let users upload raw, uncompressed video? Speaking of which, IME (mostly with audio), exploits more often seem to relate to encapsulation--container format, framing, etc--than to the low-level compressed blocks themselves; and those parts certainly are controlled by the client, at least at ingest. I don't know if that's simply because more people (albeit still small in absolute terms) are capable of understanding and breaking encapsulation implementations as opposed to the math-heavy block (de)compression routines, or because the (de)compression algorithms natural bound the scale of the output--e.g. a compressed 44.1khz AAC frame is not going to expand to more than 44.1k samples, and each sample won't be larger than the parameterized bit size. Either way, anyone distributing multimedia should account for this stuff. Alas, most don't seem to bother; they just pass off files to an ffmpeg binary or wrapper and hope for the best.
- jjcm 6y agoI think you've misunderstood. I'm saying that I wouldn't want to directly serve a client-encoded video without doing an encoding pass on the server. Youtube re-encodes all video regardless of the format it's uploaded in.
- golemiprague 6y agobut if it encode it in your webpage with your ffmpeg tool then unless someone interfere with it maliciously in some way it should not be different to encoding it on the server
- kmeisthax 6y agoIn the early days of YouTube you could upload FLVs that were served directly to users (this was back when their only playback format was Flash Video). It let you get high-quality video before that was an official option, and some people even had "fun" with malicious FLVs that crashed your browser via Flash.