9 ms·

From TFA this was telling: Thus, as Mark Atwood, an open source policy expert, pointed out on Twitter, he had to keep telling Amazon to not do things that woul

by phkahler 11mo ago

From TFA this was telling: Thus, as Mark Atwood, an open source policy expert, pointed out on Twitter, he had to keep telling Amazon to not do things that would mess up FFmpeg because, he had to keep explaining to his bosses that “They are not a vendor, there is no NDA, we have no leverage, your VP has refused to help fund them, and they could kill three major product lines tomorrow with an email. So, stop, and listen to me … ” I agree with the headline here. If Google can pay someone to find bugs, they can pay someone to fix them. How many time have managers said "Don't come to me with problems, come with solutions"

skrebbel 11mo ago
How could ffmpeg maintainers kill three major AWS product lines with an email?
- zxspectrum1982 11mo ago
  Easy: ffmpeg discontinues or relicenses some ffmpeg functionality that AWS depends on for those product alines and AWS is screwed. I've seen that happen in other open source projects.
  - portaouflop 11mo ago
    Wouldn’t that only affect new versions and current versions are still licensed under the old license ?
  - NewsaHackO 11mo ago
    But if it gets relicensed, they would still be able to use the current version. Amazon definitely would be able to fund an independent fork.
    - wewtyflakes 11mo ago
      Sounds like it would be a lot of churn for nothing; if they can fund a fork, then they could fund the original project, no?
      - arrowleaf 11mo ago
        If they can fund a fork, they can continue business as usual until the need arises
        zrm 11mo ago
        A fork is more expensive to maintain than funding/contributing to the original project. You have to duplicate all future work yourselves, third party code starts expecting their version instead of your version, etc.
        rs186 11mo ago
        Nobody said the fork cannot diverge from the original project.
      - cortesoft 11mo ago
        They COULD, but history has shown they would rather start and maintain their own fork. It might not make sense morally, but it makes total sense from a business perspective… if they are going to pay for the development, they are going to want to maintain control.
        edoceo 11mo ago
        If they want that level of control, reimburse for all the prior development too. - ie: buy that business. As it stands, they're just abusing someone's gift. Like jerks.
        rolandog 11mo ago
        There should be a "if you use this product in a for-profit environment, and you have a yearly revenue of $500,000,000,000+ ... you can afford to pay X * 100,000/yr" license.
        renewiltord 11mo ago
    - schainks 11mo ago
      It still takes expensive humans to do this so they are incentivized to use the free labor.
      - NewsaHackO 11mo ago
        Yes, definitely. I was just saying that if the license ever did change, they would move to an in-house library. In fact, they would probably release the library for consumer use as an AWS product.
    - deleted 11mo ago
      [deleted]
    - deaddodo 11mo ago
      And then the argument for refusing to just pay ffmpeg developers gets even more flimsy. The entire point here is to pay for the fixes/features you keep demanding, else the project is just going to do as it desires and ignore you. More and more OSS projects are getting to this point as large enterprises (especially in the SaaS/PaaS spheres) continue to take advantage of those projects and treat them like unpaid workers.
      - zdragnar 11mo ago
        Not really. Their whole reason for not funding open source is it essentially funds their competitors who use the same projects. That's why they'd rather build a closed fork in-house than just hand money to ffmpeg. It's a dumb reason, especially when there are CVE bugs like this one, but that's how executives think.
        Kim_Bruning 11mo ago
        But their competitors also fund them, which makes it a net positive sum.
        AnthonyMouse 11mo ago
        > Their whole reason for not funding open source is it essentially funds their competitors who use the same projects. That's why they'd rather build a closed fork in-house than just hand money to ffmpeg. So the premise here is that AWS should waste their own money maintaining an internal fork in order to try to make their competitors do the same thing? But then Google or Intel or someone just fixes it a bit later and wisely upstreams it so they can pay less than you by not maintaining an internal fork. Meanwhile you're still paying the money even though the public version has the fix because now you either need to keep maintaining your incompatible fork or pay again to switch back off of it. So what you've done is buy yourself a competitive disadvantage. > that's how executives think. That's how cargo cult executives think. Just because you've seen someone else doing something doesn't mean you should do it. They might not be smarter than you.
        illuminator83 11mo ago
    - 8note 11mo ago
      something more dangerous would be "amazon is already breaking the license, but the maintainers for now havent put in the work to stop the infringement"
    - eptcyka 11mo ago
      Oh the irony - we don't want to pay for ffmpeg's development, but sure can finance a fork if we have to.
  - astrange 11mo ago
    ffmpeg cannot relicense anything because it doesn't own anything. The contributors own the license to their code.
    - deaddodo 11mo ago
      I don’t know about ffmpeg, but plenty of OSS projects have outlined rules for who/when a project-wide/administrative decision can be made. It’s usually outlined in a CONTRIB or similar file.
      - astrange 11mo ago
        Doubtful that's enough for a copyright grant. You'd need a signed CLA.
        deaddodo 11mo ago
        No one said make it proprietary; there are other OSS licenses that would make ffmpeg non-viable for commercial usage.
        astrange 11mo ago
        You need a copyright grant to change the license in any way.
        astrange 11mo ago
        (Except for the part in the LGPL that lets you relicense it to later versions.)
    - colonwqbang 11mo ago
      Relicensing isn't necessary. If you violate the GPL with respect to a work you automatically lose your license to that work. It's enough if one or two main contributors assert their copyrights. Their contributions are so tangled with everything else after years of development that it can't meaningfully be separated away.
- mschuster91 11mo ago
  I'd guess Prime Video heavily relies on ffmpeg, then you got Elastic Transcode and the Elemental Video Services. Probably Cloudfront also has special things for streaming that rely on ffmpeg. The "kill it with an email" probably means that whoever said this is afraid that some usecase there wouldn't stand up to an audit by the usual patent troll mothercluckers. The patents surrounding video are so complex, old and plentiful that I'd assume full compliance is outright impossible.
  - noir_lord 11mo ago
    AWS MediaConvert as well which is a huge API (in surface it covers) which is under Elemental but is kinda it's own thing - willing to bet (though I don't know) that that is ffmpeg somewhere underneath. The API manual for it is nearly 4000 pages and it can do insane stuff[1]. I had to use it at last job(TM), it's not terrible API wise. [1] https://docs.aws.amazon.com/pdfs/mediaconvert/latest/apireference/mediaconvert-api.pdf https://docs.aws.amazon.com/pdfs/mediaconvert/latest/apirefe... CAUTION: big PDF.
    - bigiain 11mo ago
      " ... and it can do insane stuff" That's a pretty good indicator it's likely just ffmpeg in an AWS Hoodie/Trenchcoat.
- joshkel 11mo ago
  In a follow-up tweet, Mark Atwood eloborates: "Amazon was very carefully complying with the licenses on FFmpeg. One of my jobs there was to make sure the company was doing so. Continuing to make sure the company was was often the reason I was having a meeting like that inside the company." I interpret this as meaning there was an implied "if you screw this up" at the end of "they could kill three major product lines with an email."
  - phkahler 11mo ago
    Are you interpreting that as "if we violate the license, they can revoke our right to use the software" ?? And they use it in 3 products so that would be really bad. That would make sense to have a compliance person.
    - zinekeller 11mo ago
      Possibly Twitch, Amazon Prime Video, and another one that escapes my mind (AWS-related?).
      - procflora 11mo ago
        AWS for sure (Elemental maybe?), but could also be Ring.
        bigiain 11mo ago
        Yeah - Amazon Elastic Transcoder which they just shut down and replaced with Elemental MediaConvert is almost certainly just managed "ffmpeg as a Service" under the hood.
      - a_vanderbilt 11mo ago
        And Blink. I used to contract with them a few years back, they all rely heavily on open source.
      - troupo 11mo ago
        Twitch definitely. This whole brouhaha has been brewing for a while, and can be traced back to a spat between Theo and ffmpeg. In the now deleted tweet Theo thrashed VLC codecs to which ffmpeg replied basically "send patches, but you wouldn't be able to". The reply to which was --- start quote --- https://x.com/theo/status/1952441894023389357 https://x.com/theo/status/1952441894023389357 You clearly have no idea how much of my history was in ffmpeg. I built a ton of early twitch infra on top of yall. --- end quote --- This culminated in Theo offering a 20k bounty to ffmpeg if they remove the people running ffmpeg twitter account. Which prompted a lot of heated discussion. So when Google Project Zero posted their bug... ffmpeg went understandably ballistic
- DragonStrength 11mo ago
  Open up an Amazon media app and navigate around enough, and you'll encounter a page with all their "Third Party Software Licenses." For instance, here's one for the Amazon Music apps, which includes an FFMpeg license: https://www.amazon.com/gp/help/customer/display.html?nodeId=201420340 https://www.amazon.com/gp/help/customer/display.html?nodeId=...
  - skrebbel 11mo ago
    And? How does that give the ffmpeg authors a power over Amazon? (Hint: it doesn’t and the guy we’re discussing is spewing nonsense for maximum retweets)
  - rossant 11mo ago
    Is the idea that ffmpeg could change its license and wreak havoc?
- loodish 11mo ago
  If you breach the LGPLv2/GPLv2 licence then you lose all rights to use the software. There's no penalty clause, there's no recovery clause. If you don't comply with the licence conditions then you don't have a licence. If you don't have a licence then you can't use the program, any version of the program. And if your products depend on that program then you lose your products. The theoretical email would be a notification that they had breached the licence and could no longer use the software. The obvious implication being that AWS was wanting to do something that went contrary to the restrictions in the GPL, and he was trying to convince them not to.
zxspectrum1982 11mo ago
Google is not paying anyone to find bugs. They are running AIs indiscriminately.
- rescbr 11mo ago
  Still, they are paying for the computing resources needed to run the AI/agents etc.
  - tekbruh9000 11mo ago
    [dead]
- dtech 11mo ago
  Someone is making the tools to find these bugs. It's not like they're telling ChatGPT "go find bugs lol"
  - foobarchu 11mo ago
    And running those models on large codebases like these isnt anywhere close to free either.
- pimlottc 11mo ago
  Someone started it running, they are responsible for the results.
- rsanek 11mo ago
  https://en.wikipedia.org/wiki/Project_Zero https://en.wikipedia.org/wiki/Project_Zero
- nimih 11mo ago
  They certainly paid someone to run the so-called AIs.
- knowitnone3 11mo ago
  Does it matter? Either it's a valid bug or it's not. Either it's of high importance or it's not.
dvfjsdhgfv 11mo ago
> "Don't come to me with problems, come with solutions" The problem is, the issue in the article is explicitly named as "CVE slop", so if the patch is of the same quality, it might require quite some work anyway.
- jeffbee 11mo ago
  The linked report seems to me to be the furthest thing from "slop". It is an S-tier bug report that includes a complete narrative, crash artifacts, and detailed repro instructions. I can't believe anyone is complaining about what is tied for the best bug report I have ever seen. https://issuetracker.google.com/issues/440183164?pli=1 https://issuetracker.google.com/issues/440183164?pli=1
  - michaelt 11mo ago
    It's a good quality bug report. But it's also a bug report about the decoder for "SANM ANIM v0" - a format so obscure almost all the search results are the bug report itself. Possibly a format exclusive to mid-1990s LucasArts games [1] Pretty crazy that ffmpeg supports the codec in the first place, IMHO. I can understand volunteers not wanting to sink time into maintaining a codec to play a video format that hasn't been used since the Clinton administration. gstreamer divides their plugins into 'good', 'bad' and 'ugly' to give them somewhere to stash unmaintained codecs. [1] https://web.archive.org/web/20250419105551/https://wiki.multimedia.cx/index.php/SAN https://web.archive.org/web/20250419105551/https://wiki.mult...
    - jsnell 11mo ago
      It's a codec that is enabled by default at least on major Linux distributions, and that will be processed by ffmpeg without any extra flags. Anyone playing an untrusted video file without explictly overriding the codec autodetection is vulnerable. The format being obscure and having no real usage doesn't help when it's the attackers creating the files. The obscure formats are exposing just as much attack surface as the common ones. > Pretty crazy that ffmpeg supports the codec in the first place, IMHO. Yes.
skhameneh 11mo ago
I've been a proponent of upstreaming fixes for open source software. Why? - It makes continued downstream consumption easier, you don't have to rely on fragile secret patches. - It gives back to projects that helped you to begin with, it's a simple form of paying it forward. - It all around seems like the "ethical" and "correct" thing to do. Unfortunately, in my experience, there's often a lot of barriers within companies to upstream. Reasons can be everything from compliance, processes, you name it... It's unfortunate. I have a very distinct recollection of talks about hardware aspirations and upstreaming software fixes at a large company. The cultural response was jarring.
- wmf 11mo ago
  It would probably be easier for these companies to pay Collabora or Igalia.
- Astronaut3315 11mo ago
  I upstreamed a 1-line fix, plus tests, at my previous company. I had to go through a multi-month process of red tape and legal reviews to make it happen. That was a discouraging experience to say the least.
  - toast0 11mo ago
    My favorite is when while you were working through all that, the upstream decided they need a CLA. And then you have to go through another round of checking to see if your company thinks it's ok for you to agree to sign that for a 1 line change. Certainly easier to give a good bug report and let upstream write the change, if they will.
  - jamwil 11mo ago
    In this scenario does your employer have strong controls around what whether you can write hobby code on your own time?
    - achierius 11mo ago
      Generally yes. Or yes, you could just do it yourself in your free time.
deleted 11mo ago
[deleted]
poulpy123 11mo ago
Nothing says solid industry better than having 3 majors product lines from a trillion dollar company depending of unpaid volunteer labor.
- Cthulhu_ 11mo ago
  I think if you look a bit deeper, all product lines from said trillion dollor company rely on open source to some degree. They should be spending hundreds of millions in sponsorship of OS projects. They should put the maintainers on their payroll. Not even reporting to a manager, just pay them a salary for their OS work.
  - chanux 11mo ago
    I have a feeling that if they do this, the economy would be hurt (somehow). None of us want the economy to be hurt, right?
    - estimator7292 11mo ago
      That's what's going to happen when these corporations extract the last value from OSS and all the maintainers give up, so..
bjourne 11mo ago
Finding the bug is 95% of the effort. The idea that reporting obscure security bugs is worthless is BS.
commandersaki 11mo ago
If Google can pay someone to find bugs, they can pay someone to fix them. Sounds like they'll just throw their employees to work on it rather than monetarily fund it, that way they can aura farm.
- etruong42 11mo ago
  As a Googler, I wish I was as optimistic as you. There is an internal sentiment that valuable roles are being removed that aren't aligned with strategic initiatives, even roles that are widely believed to improve developer productivity. See the entire python maintainers team being laid off: https://www.reddit.com/r/AskProgramming/comments/1cem1wk/google_laysoff_entire_python_team/ https://www.reddit.com/r/AskProgramming/comments/1cem1wk/goo... Roles fixing FFmpeg bugs would be a hard sell in this environment, imho.

skrebbel 11mo ago

How could ffmpeg maintainers kill three major AWS product lines with an email?

zxspectrum1982 11mo ago
Easy: ffmpeg discontinues or relicenses some ffmpeg functionality that AWS depends on for those product alines and AWS is screwed. I've seen that happen in other open source projects.
- portaouflop 11mo ago
  Wouldn’t that only affect new versions and current versions are still licensed under the old license ?
- NewsaHackO 11mo ago
  But if it gets relicensed, they would still be able to use the current version. Amazon definitely would be able to fund an independent fork.
  - wewtyflakes 11mo ago
    Sounds like it would be a lot of churn for nothing; if they can fund a fork, then they could fund the original project, no?
    - arrowleaf 11mo ago
      If they can fund a fork, they can continue business as usual until the need arises
      - zrm 11mo ago
        A fork is more expensive to maintain than funding/contributing to the original project. You have to duplicate all future work yourselves, third party code starts expecting their version instead of your version, etc.
        rs186 11mo ago
        Nobody said the fork cannot diverge from the original project.
    - cortesoft 11mo ago
      They COULD, but history has shown they would rather start and maintain their own fork. It might not make sense morally, but it makes total sense from a business perspective… if they are going to pay for the development, they are going to want to maintain control.
      - edoceo 11mo ago
        If they want that level of control, reimburse for all the prior development too. - ie: buy that business. As it stands, they're just abusing someone's gift. Like jerks.
        rolandog 11mo ago
        There should be a "if you use this product in a for-profit environment, and you have a yearly revenue of $500,000,000,000+ ... you can afford to pay X * 100,000/yr" license.
        renewiltord 11mo ago
  - schainks 11mo ago
    It still takes expensive humans to do this so they are incentivized to use the free labor.
    - NewsaHackO 11mo ago
      Yes, definitely. I was just saying that if the license ever did change, they would move to an in-house library. In fact, they would probably release the library for consumer use as an AWS product.
  - deleted 11mo ago
    [deleted]
  - deaddodo 11mo ago
    And then the argument for refusing to just pay ffmpeg developers gets even more flimsy. The entire point here is to pay for the fixes/features you keep demanding, else the project is just going to do as it desires and ignore you. More and more OSS projects are getting to this point as large enterprises (especially in the SaaS/PaaS spheres) continue to take advantage of those projects and treat them like unpaid workers.
    - zdragnar 11mo ago
      Not really. Their whole reason for not funding open source is it essentially funds their competitors who use the same projects. That's why they'd rather build a closed fork in-house than just hand money to ffmpeg. It's a dumb reason, especially when there are CVE bugs like this one, but that's how executives think.
      - Kim_Bruning 11mo ago
        But their competitors also fund them, which makes it a net positive sum.
      - AnthonyMouse 11mo ago
        > Their whole reason for not funding open source is it essentially funds their competitors who use the same projects. That's why they'd rather build a closed fork in-house than just hand money to ffmpeg. So the premise here is that AWS should waste their own money maintaining an internal fork in order to try to make their competitors do the same thing? But then Google or Intel or someone just fixes it a bit later and wisely upstreams it so they can pay less than you by not maintaining an internal fork. Meanwhile you're still paying the money even though the public version has the fix because now you either need to keep maintaining your incompatible fork or pay again to switch back off of it. So what you've done is buy yourself a competitive disadvantage. > that's how executives think. That's how cargo cult executives think. Just because you've seen someone else doing something doesn't mean you should do it. They might not be smarter than you.
        illuminator83 11mo ago
  - 8note 11mo ago
    something more dangerous would be "amazon is already breaking the license, but the maintainers for now havent put in the work to stop the infringement"
  - eptcyka 11mo ago
    Oh the irony - we don't want to pay for ffmpeg's development, but sure can finance a fork if we have to.
- astrange 11mo ago
  ffmpeg cannot relicense anything because it doesn't own anything. The contributors own the license to their code.
  - deaddodo 11mo ago
    I don’t know about ffmpeg, but plenty of OSS projects have outlined rules for who/when a project-wide/administrative decision can be made. It’s usually outlined in a CONTRIB or similar file.
    - astrange 11mo ago
      Doubtful that's enough for a copyright grant. You'd need a signed CLA.
      - deaddodo 11mo ago
        No one said make it proprietary; there are other OSS licenses that would make ffmpeg non-viable for commercial usage.
        astrange 11mo ago
        You need a copyright grant to change the license in any way.
        astrange 11mo ago
        (Except for the part in the LGPL that lets you relicense it to later versions.)
  - colonwqbang 11mo ago
    Relicensing isn't necessary. If you violate the GPL with respect to a work you automatically lose your license to that work. It's enough if one or two main contributors assert their copyrights. Their contributions are so tangled with everything else after years of development that it can't meaningfully be separated away.
mschuster91 11mo ago
I'd guess Prime Video heavily relies on ffmpeg, then you got Elastic Transcode and the Elemental Video Services. Probably Cloudfront also has special things for streaming that rely on ffmpeg. The "kill it with an email" probably means that whoever said this is afraid that some usecase there wouldn't stand up to an audit by the usual patent troll mothercluckers. The patents surrounding video are so complex, old and plentiful that I'd assume full compliance is outright impossible.
- noir_lord 11mo ago
  AWS MediaConvert as well which is a huge API (in surface it covers) which is under Elemental but is kinda it's own thing - willing to bet (though I don't know) that that is ffmpeg somewhere underneath. The API manual for it is nearly 4000 pages and it can do insane stuff[1]. I had to use it at last job(TM), it's not terrible API wise. [1] https://docs.aws.amazon.com/pdfs/mediaconvert/latest/apireference/mediaconvert-api.pdf https://docs.aws.amazon.com/pdfs/mediaconvert/latest/apirefe... CAUTION: big PDF.
  - bigiain 11mo ago
    " ... and it can do insane stuff" That's a pretty good indicator it's likely just ffmpeg in an AWS Hoodie/Trenchcoat.
joshkel 11mo ago
In a follow-up tweet, Mark Atwood eloborates: "Amazon was very carefully complying with the licenses on FFmpeg. One of my jobs there was to make sure the company was doing so. Continuing to make sure the company was was often the reason I was having a meeting like that inside the company." I interpret this as meaning there was an implied "if you screw this up" at the end of "they could kill three major product lines with an email."
- phkahler 11mo ago
  Are you interpreting that as "if we violate the license, they can revoke our right to use the software" ?? And they use it in 3 products so that would be really bad. That would make sense to have a compliance person.
  - zinekeller 11mo ago
    Possibly Twitch, Amazon Prime Video, and another one that escapes my mind (AWS-related?).
    - procflora 11mo ago
      AWS for sure (Elemental maybe?), but could also be Ring.
      - bigiain 11mo ago
        Yeah - Amazon Elastic Transcoder which they just shut down and replaced with Elemental MediaConvert is almost certainly just managed "ffmpeg as a Service" under the hood.
    - a_vanderbilt 11mo ago
      And Blink. I used to contract with them a few years back, they all rely heavily on open source.
    - troupo 11mo ago
      Twitch definitely. This whole brouhaha has been brewing for a while, and can be traced back to a spat between Theo and ffmpeg. In the now deleted tweet Theo thrashed VLC codecs to which ffmpeg replied basically "send patches, but you wouldn't be able to". The reply to which was --- start quote --- https://x.com/theo/status/1952441894023389357 https://x.com/theo/status/1952441894023389357 You clearly have no idea how much of my history was in ffmpeg. I built a ton of early twitch infra on top of yall. --- end quote --- This culminated in Theo offering a 20k bounty to ffmpeg if they remove the people running ffmpeg twitter account. Which prompted a lot of heated discussion. So when Google Project Zero posted their bug... ffmpeg went understandably ballistic
DragonStrength 11mo ago
Open up an Amazon media app and navigate around enough, and you'll encounter a page with all their "Third Party Software Licenses." For instance, here's one for the Amazon Music apps, which includes an FFMpeg license: https://www.amazon.com/gp/help/customer/display.html?nodeId=201420340 https://www.amazon.com/gp/help/customer/display.html?nodeId=...
- skrebbel 11mo ago
  And? How does that give the ffmpeg authors a power over Amazon? (Hint: it doesn’t and the guy we’re discussing is spewing nonsense for maximum retweets)
- rossant 11mo ago
  Is the idea that ffmpeg could change its license and wreak havoc?
loodish 11mo ago
If you breach the LGPLv2/GPLv2 licence then you lose all rights to use the software. There's no penalty clause, there's no recovery clause. If you don't comply with the licence conditions then you don't have a licence. If you don't have a licence then you can't use the program, any version of the program. And if your products depend on that program then you lose your products. The theoretical email would be a notification that they had breached the licence and could no longer use the software. The obvious implication being that AWS was wanting to do something that went contrary to the restrictions in the GPL, and he was trying to convince them not to.

zxspectrum1982 11mo ago

Google is not paying anyone to find bugs. They are running AIs indiscriminately.

rescbr 11mo ago
Still, they are paying for the computing resources needed to run the AI/agents etc.
- tekbruh9000 11mo ago
  [dead]
dtech 11mo ago
Someone is making the tools to find these bugs. It's not like they're telling ChatGPT "go find bugs lol"
- foobarchu 11mo ago
  And running those models on large codebases like these isnt anywhere close to free either.
pimlottc 11mo ago
Someone started it running, they are responsible for the results.
rsanek 11mo ago
https://en.wikipedia.org/wiki/Project_Zero https://en.wikipedia.org/wiki/Project_Zero
nimih 11mo ago
They certainly paid someone to run the so-called AIs.
knowitnone3 11mo ago
Does it matter? Either it's a valid bug or it's not. Either it's of high importance or it's not.

dvfjsdhgfv 11mo ago

> "Don't come to me with problems, come with solutions" The problem is, the issue in the article is explicitly named as "CVE slop", so if the patch is of the same quality, it might require quite some work anyway.

jeffbee 11mo ago
The linked report seems to me to be the furthest thing from "slop". It is an S-tier bug report that includes a complete narrative, crash artifacts, and detailed repro instructions. I can't believe anyone is complaining about what is tied for the best bug report I have ever seen. https://issuetracker.google.com/issues/440183164?pli=1 https://issuetracker.google.com/issues/440183164?pli=1
- michaelt 11mo ago
  It's a good quality bug report. But it's also a bug report about the decoder for "SANM ANIM v0" - a format so obscure almost all the search results are the bug report itself. Possibly a format exclusive to mid-1990s LucasArts games [1] Pretty crazy that ffmpeg supports the codec in the first place, IMHO. I can understand volunteers not wanting to sink time into maintaining a codec to play a video format that hasn't been used since the Clinton administration. gstreamer divides their plugins into 'good', 'bad' and 'ugly' to give them somewhere to stash unmaintained codecs. [1] https://web.archive.org/web/20250419105551/https://wiki.multimedia.cx/index.php/SAN https://web.archive.org/web/20250419105551/https://wiki.mult...
  - jsnell 11mo ago
    It's a codec that is enabled by default at least on major Linux distributions, and that will be processed by ffmpeg without any extra flags. Anyone playing an untrusted video file without explictly overriding the codec autodetection is vulnerable. The format being obscure and having no real usage doesn't help when it's the attackers creating the files. The obscure formats are exposing just as much attack surface as the common ones. > Pretty crazy that ffmpeg supports the codec in the first place, IMHO. Yes.

skhameneh 11mo ago

I've been a proponent of upstreaming fixes for open source software. Why? - It makes continued downstream consumption easier, you don't have to rely on fragile secret patches. - It gives back to projects that helped you to begin with, it's a simple form of paying it forward. - It all around seems like the "ethical" and "correct" thing to do. Unfortunately, in my experience, there's often a lot of barriers within companies to upstream. Reasons can be everything from compliance, processes, you name it... It's unfortunate. I have a very distinct recollection of talks about hardware aspirations and upstreaming software fixes at a large company. The cultural response was jarring.

wmf 11mo ago
It would probably be easier for these companies to pay Collabora or Igalia.
Astronaut3315 11mo ago
I upstreamed a 1-line fix, plus tests, at my previous company. I had to go through a multi-month process of red tape and legal reviews to make it happen. That was a discouraging experience to say the least.
- toast0 11mo ago
  My favorite is when while you were working through all that, the upstream decided they need a CLA. And then you have to go through another round of checking to see if your company thinks it's ok for you to agree to sign that for a 1 line change. Certainly easier to give a good bug report and let upstream write the change, if they will.
- jamwil 11mo ago
  In this scenario does your employer have strong controls around what whether you can write hobby code on your own time?
  - achierius 11mo ago
    Generally yes. Or yes, you could just do it yourself in your free time.

deleted 11mo ago

[deleted]

poulpy123 11mo ago

Nothing says solid industry better than having 3 majors product lines from a trillion dollar company depending of unpaid volunteer labor.

Cthulhu_ 11mo ago
I think if you look a bit deeper, all product lines from said trillion dollor company rely on open source to some degree. They should be spending hundreds of millions in sponsorship of OS projects. They should put the maintainers on their payroll. Not even reporting to a manager, just pay them a salary for their OS work.
- chanux 11mo ago
  I have a feeling that if they do this, the economy would be hurt (somehow). None of us want the economy to be hurt, right?
  - estimator7292 11mo ago
    That's what's going to happen when these corporations extract the last value from OSS and all the maintainers give up, so..

bjourne 11mo ago

Finding the bug is 95% of the effort. The idea that reporting obscure security bugs is worthless is BS.

commandersaki 11mo ago

If Google can pay someone to find bugs, they can pay someone to fix them. Sounds like they'll just throw their employees to work on it rather than monetarily fund it, that way they can aura farm.

etruong42 11mo ago
As a Googler, I wish I was as optimistic as you. There is an internal sentiment that valuable roles are being removed that aren't aligned with strategic initiatives, even roles that are widely believed to improve developer productivity. See the entire python maintainers team being laid off: https://www.reddit.com/r/AskProgramming/comments/1cem1wk/google_laysoff_entire_python_team/ https://www.reddit.com/r/AskProgramming/comments/1cem1wk/goo... Roles fixing FFmpeg bugs would be a hard sell in this environment, imho.