3 ms·

> Pages here and here list hundreds of packages for Ubuntu and Debian alone that rely on the library known as libvpx. Most browsers use it, and the list of soft

> Pages here and here list hundreds of packages for Ubuntu and Debian alone that rely on the library known as libvpx. Most browsers use it, and the list of software or vendors supporting it reads like a who’s who of the Internet, including Skype, Adobe, VLC, and Android. I guess there's a trade-off between reinventing the wheel vs. being open to 0-days that take down a lot of projects at a time. The upside is of the current situation is that it will likely be patched more quickly than a smaller project would be able to since everyone will be looking at libvpx right now. One shared library update will fix a lot of programs, though if they use snap or flatpack or statically include it then it will be more of a mess.

cwillu 3y ago
How many packages send untrusted input to the encoder though? It's a vulnerability in the context of a browser because the browser provides to any page, the ability to send arbitrary malformed data to the encoder. Many applications present images from untrusted sources. I'm having a hard time thinking of a single application that will _encode_ untrusted input, beyond a browser.
- masklinn 3y ago
  I would assume any website which stores and displays video transcodes them to known internal specs and format. YouTube certainly does.
  - cwillu 3y ago
    It's a vulnerability that needs to be patched and may have major impacts on some services. It's _not_ a vulnerability that needs to be mentioned alongside the webp cve lest the public be caught unaware of something they need to update on every phone and laptop they own.
thephyber 3y ago
> there's a trade-off between reinventing the wheel vs. being open to 0-days that take down a lot of projects at a time. I have come to think about it more as comparative advantage of different programmers and their training / skill set. Not everyone has the skills to write a complex state machine for stream encoding (I haven’t read up on libvpx, so forgive me if I mischaracterized it). We shouldn’t expect a huge diversity of available libraries to do this task. But we should have more tools to inform the consumer of libraries to see their risk from any individual library and there should be more transparency about alternatives/substitutes to make sure we don’t see a monoculture around an inferior library if a superior option exists. We should expect specialists to write specialized code. But we should also have QA specialists (and hopefully lots of automation) review the code. And the more systems a library is installed on, the more verification/scrutiny should be put on that code. This is the strategy of Project Zero (Google’s 0day hunting project) and lots of other organizations should contribute similar efforts.
sassy_quat 3y ago
[dead]

cwillu 3y ago

How many packages send untrusted input to the encoder though? It's a vulnerability in the context of a browser because the browser provides to any page, the ability to send arbitrary malformed data to the encoder. Many applications present images from untrusted sources. I'm having a hard time thinking of a single application that will _encode_ untrusted input, beyond a browser.

masklinn 3y ago
I would assume any website which stores and displays video transcodes them to known internal specs and format. YouTube certainly does.
- cwillu 3y ago
  It's a vulnerability that needs to be patched and may have major impacts on some services. It's _not_ a vulnerability that needs to be mentioned alongside the webp cve lest the public be caught unaware of something they need to update on every phone and laptop they own.

thephyber 3y ago

> there's a trade-off between reinventing the wheel vs. being open to 0-days that take down a lot of projects at a time. I have come to think about it more as comparative advantage of different programmers and their training / skill set. Not everyone has the skills to write a complex state machine for stream encoding (I haven’t read up on libvpx, so forgive me if I mischaracterized it). We shouldn’t expect a huge diversity of available libraries to do this task. But we should have more tools to inform the consumer of libraries to see their risk from any individual library and there should be more transparency about alternatives/substitutes to make sure we don’t see a monoculture around an inferior library if a superior option exists. We should expect specialists to write specialized code. But we should also have QA specialists (and hopefully lots of automation) review the code. And the more systems a library is installed on, the more verification/scrutiny should be put on that code. This is the strategy of Project Zero (Google’s 0day hunting project) and lots of other organizations should contribute similar efforts.

sassy_quat 3y ago

[dead]