5 ms·
A bunch of people who make era-defining software for free. A labor of love. Another bunch of people who make era-defining software where they extract everythin
by profsummergig 11mo ago
A bunch of people who make era-defining software for free. A labor of love.
Another bunch of people who make era-defining software where they extract everything they can. From customers, transactionally. From the first bunch, pure extraction (slavery, anyone?).
- ivell 11mo agoIrrespective of what Google does, security research is still useful for all of us. They could adopt a more flexible policy for FOSS though.
- doctorwho42 11mo agoOr they could contribute solutions to said bugs? Its not like they would distract that much from their bottom line
- SR2Z 11mo agoGoogle is a major contributor to open-source video, to the point where it would not be viable without them.
- FridgeSeal 11mo ago[flagged]
- SR2Z 11mo agoLook, I know you're being snarky, but YES. All of the viable open-source video codecs of the past 10 years would not have happened without Google. Not just for technical reasons, but for expensive patent-related legal reasons too. Given that ffmpeg is an open-source video transcoding tool, I don't think you can easily just dismiss this as "big company abuses open source." The ffmpeg devs are volunteers or paid to work on specific parts of the tool. That's why they're unimpressed. What Google is doing here is pretty reasonable.
- degamad 11mo agoExactly. The call-out is not "please stop doing security research". It is, "if you have a lot of money to spend on security research, please spend some of it on discovering the bugs, and some on fixing them (or paying us to fix them), instead of all of it on discovering bugs too fast for us to fix them in time".
- adastra22 11mo agoIs it? I’ve gotten nothing but headaches from these automated CVE-seeking teams.
- viraptor 11mo agoYou got lower chances of getting hacked by a random file on the internet. At Project Zero level they're also not CVE seeking - it doesn't even matter at that scale, it's not an independent trying to become known.
- adastra22 11mo agoI have yet to see one on any project I’ve been attached to that was actually exploitable under real circumstances. But the CVE hunting teams treat them all as if they were.
- saagarjha 11mo agoYou should honestly consider not responding if you are unaware of Project Zero.
- adastra22 11mo agoTFA is about Project Zero getting uppity about an unexploitable non-issue in ffmpeg. Project Zero hasn't reported any vulnerabilities in any software I maintain. Lots of other security groups have, some well respected as well, but to my knowledge none of these "outside" reports were actual vulnerabilities when analyzed in context.
- saagarjha 11mo agoYou are welcome to view the report however you like, but a world where an easily reproducible OOB read and UAF in the default configuration is an "unexploitable non-issue" is not reality.
- xuhu 11mo agoIt's as useful as brute forcing one of your neighbor's 100 online passwords every day and writing it on the door of a random supermarket.
- samdoesnothing 11mo agoIt's hard to find an easier good vs evil distinction than between Google and literally anybody else.
- criticalfault 11mo agoMicrosoft ♥ Linux?
- machomaster 11mo agoVim vs. Emacs
- lern_too_spel 11mo agoFacebook?
- samdoesnothing 11mo agoProbably a tie!
- Hammershaft 11mo agoWhat is happening to hacker news? I'm not a fan of Google but this discourse is so tribal and reductive.
- dzhiurgis 11mo ago> era-defining software for free chill, nobody knows what ffmpeg is
- tills13 11mo agoIs this sarcasm? While it may be true that my mother does not know what ffmpeg is I'm almost positive she interacts with stuff that uses it literally every single day.
- profsummergig 11mo ago...every media post on IG/FB/X/YT/news sites/AI.
- dzhiurgis 11mo agoSo does a Siemens transformer, but it's era defining. Why there's such a weird toxic empathy around ffmpeg?
- Orygin 11mo agoWhy do you shit on it? This software is literally holding the near entirety of video transcoding *worldwide* on its shoulders.
- dzhiurgis 11mo agoGood on them, can they and their groupies a bit more chill when facing valid criticism. If this wasn't google but lone developer by now he'd be doxxed, fired and receiving death threats. It's not first time ffmpeg strikes like this.
- Aurornis 11mo ago> (slavery, anyone?) It’s hard to take any comment seriously that tries to use “slavery” for situations where nobody is forced to do anything for anyone.
- profsummergig 11mo ago[flagged]
- Aurornis 11mo agoAnyone comparing normal adulthood stuff to slavery needs to spend some time reading some history books.
- profsummergig 11mo agoSo, no answer?
- raincole 11mo agoAnyone who actually read some history books would know slavery was considered "normal stuff" until it wasn't.
- hennell 11mo agoNot how the terms slavery and taxation are usually defined no. If you choose to reduce them to such a level you ignore all their differences and focus on some carefully termed similarities you could make the case they're the same for that specific definition I suppose.
- lm28469 11mo agoNo we can't use such strong words here, theft is more appropriate