2 ms·

> Google found a bug That does not impact their business or their operations in any way whatsoever. > If it's a valid bug then it's a valid bug end of story.

> Google found a bug That does not impact their business or their operations in any way whatsoever. > If it's a valid bug then it's a valid bug end of story. This isn't a binary. It's why CVEs have a whole sordid scoring system to go along with them. > Software owes it to its users to be secure ffmpeg owes me nothing. I haven't paid them a dime.

jeroenhd 1y ago
> That does not impact their business or their operations in any way whatsoever. I don't know what tools and backends they use exactly, but working purely by statistics, I'm sure some place in Google's massive cloud compute empire is relying on ffmpeg to process data from the internet.
- themafia 1y ago
  And they're processing old LucasArts codec videos with it? Which is the specific bug report in question.
  - inkysigma 1y ago
    It's unlikely the specific codec that is the issue but the bug report suggests that the code path could be hit by a maliciously crafted payload since ffmpeg does file fuzzing. They almost certainly have ffmpeg stuff that touches user submitted videos.
  - jeroenhd 1y ago
    They're probably not manually selecting which codecs and codec parameters to accept and sticking to the default ones instead. Plus, this bug was reported by AI, so it was as much a proof of concept/experiment/demonstration of their AI security scanner as it was an attempt to help secure ffmpeg
shevy-java 1y ago
> ffmpeg owes me nothing. I haven't paid them a dime. That is true. At the same time Google also does not owe the ffmpeg devs anything either. It applies both ways. The whole "pay us or we won't fix this" makes no sense.
- themafia 1y ago
  > Google also does not owe the ffmpeg devs anything either. Then they can stop reporting bugs with their assinine one size fits all "policy." It's unwelcome and unnecessary. > It applies both ways. The difference is I do not presume things upon the ffmpeg developers. I just use their software. > The whole "pay us or we won't fix this" makes no sense. Pay us or stop reporting obscure bugs in unused codecs found using "AI" scanning, or at least, if you do, then change your disclosure policy for those "bugs." That's the actual argument and is far more reasonable.
  - rat9988 1y ago
    I for one welcome it. I want to know if there are some vulnerabilities in the software I use.
  - milkey_mouse 1y ago
    > Then they can stop reporting bugs with their asinine one size fits all "policy." It's unwelcome and unnecessary. Right, they should just post the 0days on their blog.
vsgherzi 1y ago
It doesn’t matter if it affects their business or not. They found an issue and they reported it. Ffmpeg could request that they report it privately perhaps. Google has a moral duty to report the bug. Software should be correct and secure. Of course this can’t always be the case but it’s what we should strive for. I think that’s baseline

jeroenhd 1y ago

> That does not impact their business or their operations in any way whatsoever. I don't know what tools and backends they use exactly, but working purely by statistics, I'm sure some place in Google's massive cloud compute empire is relying on ffmpeg to process data from the internet.

themafia 1y ago
And they're processing old LucasArts codec videos with it? Which is the specific bug report in question.
- inkysigma 1y ago
  It's unlikely the specific codec that is the issue but the bug report suggests that the code path could be hit by a maliciously crafted payload since ffmpeg does file fuzzing. They almost certainly have ffmpeg stuff that touches user submitted videos.
- jeroenhd 1y ago
  They're probably not manually selecting which codecs and codec parameters to accept and sticking to the default ones instead. Plus, this bug was reported by AI, so it was as much a proof of concept/experiment/demonstration of their AI security scanner as it was an attempt to help secure ffmpeg

shevy-java 1y ago

> ffmpeg owes me nothing. I haven't paid them a dime. That is true. At the same time Google also does not owe the ffmpeg devs anything either. It applies both ways. The whole "pay us or we won't fix this" makes no sense.

themafia 1y ago
> Google also does not owe the ffmpeg devs anything either. Then they can stop reporting bugs with their assinine one size fits all "policy." It's unwelcome and unnecessary. > It applies both ways. The difference is I do not presume things upon the ffmpeg developers. I just use their software. > The whole "pay us or we won't fix this" makes no sense. Pay us or stop reporting obscure bugs in unused codecs found using "AI" scanning, or at least, if you do, then change your disclosure policy for those "bugs." That's the actual argument and is far more reasonable.
- rat9988 1y ago
  I for one welcome it. I want to know if there are some vulnerabilities in the software I use.
- milkey_mouse 1y ago
  > Then they can stop reporting bugs with their asinine one size fits all "policy." It's unwelcome and unnecessary. Right, they should just post the 0days on their blog.

vsgherzi 1y ago

It doesn’t matter if it affects their business or not. They found an issue and they reported it. Ffmpeg could request that they report it privately perhaps. Google has a moral duty to report the bug. Software should be correct and secure. Of course this can’t always be the case but it’s what we should strive for. I think that’s baseline