3 ms·
You are getting down voted, but you aren't really wrong, there have been 142 vulnerabilities[1] in ffmpeg since 2018, 3 in this year so far. The attack surface
by lyu07282 2y ago
You are getting down voted, but you aren't really wrong, there have been 142 vulnerabilities[1] in ffmpeg since 2018, 3 in this year so far. The attack surface is huge, with mostly memory corruption issues being found.
Not sure rust is the answer or what else could be done, but we shouldn't pretend it isn't an issue.
[1] https://stack.watch/product/ffmpeg/ffmpeg/ https://stack.watch/product/ffmpeg/ffmpeg/
- tstrimple 2y agoSo they found and fixed 142 vulnerabilities in the last 3 years and folks are advocating for them to abandon all that good work and build a new framework from scratch which reintroduces tons more bugs that are completely undiscovered. Seems like an insane path to stability to me.
- lyu07282 2y agoYou are missing the point. Nearly 100% of those bugs are due to the fact that it is written in a memory unsafe language, FFmpeg is 23 years old and we still find memory corruption bugs in it every few months. That's why people are saying to perhaps use a memory safe language instead, I don't understand why people give this such a hostile response, it has been widely accepted that C is dangerous and can not ever be made safe, to suggest anything different is denying reality.
- bogantech 2y agoA lot of it is written in ASM for performance reasons. Besides that, there's always a bunch of "this should be rewritten completely in <hot new language>" as if it's trivial to rewrite software like this from scratch but nobody ever steps up and does it, I wonder why that is?