4 ms·

Does Google seriously not have a whole team of people who help maintain ffmpeg?

by justahuman74 11mo ago

adastra22 11mo ago
Yes. But they don’t upstream. Why would they?
- justahuman74 11mo ago
  Great, they can fix the bugs being filed by another part of their company
  - Ferret7446 11mo ago
    So would you rather Google have a secure ffmpeg while us plebian individual users continue to have an insecure ffmpeg?
    - GaryBluto 11mo ago
      It's frustrating to me how many people are siding with FFmpeg here considering how unprofessional and generally asshole-ish they are being. I feel that this is mostly a kneejerk reaction to AI and Google in general, with people coming up with arguments to support their reaction after already forming an opinion.
      - NoGravitas 11mo ago
        It's a volunteer project, they have no requirement to be 'professional'. That's basically the root of the whole issue. A hobby project is not a product, and its developers are not vendors. Free software is not a supply chain.
        Dylan16807 11mo ago
        The word "unprofessional" here is muddying the comment more than it helps. Let's just saying they're being asshole-ish, which is a problem for volunteer projects just as much as non-volunteer ones. The ffmpeg twitter sucks.
        joshuamorton 11mo ago
        > A hobby project is not a product, and its developers are not vendors But it's developers do offer paid consulting as ffmpeg maintainers, which Google does pay for.
      - adastra22 11mo ago
        Because we've worked as open-source maintainers and experienced the same frustrating asshole-ish behavior from companies before.
  - warkdarrior 11mo ago
    They probably fixed in the internal version.
- cataflam 11mo ago
  Don't they? https://git.ffmpeg.org/gitweb/ffmpeg.git?a=search&h=HEAD&st=author&s=%40google.com https://git.ffmpeg.org/gitweb/ffmpeg.git?a=search&h=HEAD&st=...
dieortin 11mo ago
https://github.com/search?q=repo%3AFFmpeg%2FFFmpeg+google.com&type=commits https://github.com/search?q=repo%3AFFmpeg%2FFFmpeg+google.co...
- alecco 11mo ago
  As in another comment, adding code/fixes only adds more work to the existing ffmpeg team as they need to review and maintain it forever. It's not good enough. Even security fixes in the style of "drive-by patching" are derided in security-oriented open source projects.
alecco 11mo ago
Adding code/fixes is a tiny fraction of work compared to reviewing and maintaining. The only reasonable way is for Google and other big corps to either sponsor members of the existing team or donate money to the project. And making it long term not one-shotting for publicity.

Does Google seriously not have a whole team of people who help maintain ffmpeg?

adastra22 11mo ago

Yes. But they don’t upstream. Why would they?

justahuman74 11mo ago
Great, they can fix the bugs being filed by another part of their company
- Ferret7446 11mo ago
  So would you rather Google have a secure ffmpeg while us plebian individual users continue to have an insecure ffmpeg?
  - GaryBluto 11mo ago
    It's frustrating to me how many people are siding with FFmpeg here considering how unprofessional and generally asshole-ish they are being. I feel that this is mostly a kneejerk reaction to AI and Google in general, with people coming up with arguments to support their reaction after already forming an opinion.
    - NoGravitas 11mo ago
      It's a volunteer project, they have no requirement to be 'professional'. That's basically the root of the whole issue. A hobby project is not a product, and its developers are not vendors. Free software is not a supply chain.
      - Dylan16807 11mo ago
        The word "unprofessional" here is muddying the comment more than it helps. Let's just saying they're being asshole-ish, which is a problem for volunteer projects just as much as non-volunteer ones. The ffmpeg twitter sucks.
      - joshuamorton 11mo ago
        > A hobby project is not a product, and its developers are not vendors But it's developers do offer paid consulting as ffmpeg maintainers, which Google does pay for.
    - adastra22 11mo ago
      Because we've worked as open-source maintainers and experienced the same frustrating asshole-ish behavior from companies before.
- warkdarrior 11mo ago
  They probably fixed in the internal version.
cataflam 11mo ago
Don't they? https://git.ffmpeg.org/gitweb/ffmpeg.git?a=search&h=HEAD&st=author&s=%40google.com https://git.ffmpeg.org/gitweb/ffmpeg.git?a=search&h=HEAD&st=...

dieortin 11mo ago

https://github.com/search?q=repo%3AFFmpeg%2FFFmpeg+google.com&type=commits https://github.com/search?q=repo%3AFFmpeg%2FFFmpeg+google.co...

alecco 11mo ago
As in another comment, adding code/fixes only adds more work to the existing ffmpeg team as they need to review and maintain it forever. It's not good enough. Even security fixes in the style of "drive-by patching" are derided in security-oriented open source projects.

alecco 11mo ago

Adding code/fixes is a tiny fraction of work compared to reviewing and maintaining. The only reasonable way is for Google and other big corps to either sponsor members of the existing team or donate money to the project. And making it long term not one-shotting for publicity.