5 ms·

I feel we’re blessed to have a project like FFmpeg. This open source tool is so important for everyone.

richardstahl 2mo ago
I recommend watching the Lex Fridman interview with Jean-Baptiste Kempf and Kieran Kunhya. Amazing work on and amazing project.
- meerita 2mo ago
  It's a really good interview. I recommend it too.
- hahn-kev 2mo ago
  Link?
  - drowntoge 2mo ago
    https://youtu.be/nepKKz-MzFM https://youtu.be/nepKKz-MzFM
    - lifestyleguru 2mo ago
      How do I pay them, do they need my money, would it help ffmpeg?
- cm2187 2mo ago
  Though there is one part I didn’t understand in that interview. They were complaining of being overwhelmed by AI submitted bug reports (fair), including for obscure codecs that must have been used by a couple of users at most. And therefore implying that securing those codecs is low priority/important. I don’t understand that. To me the severity has nothing to do with how popular is a code path, but whether that code path is accessible to an attacker. If I upload a specially crafted .mkv with a little known codec on YouTube and they use ffmpeg to process it, and I compromise YouTube’s infrastructure that way, it’s a pretty big deal, no matter the popularity of that codec.
  - rbultje 2mo ago
    That sounds nice in theory, but it seems obvious to me there is a major discrepancy between who is burdened with this responsibility, and who benefits from the result. Given many of these contributors are unpaid volunteers, maybe the infrastructure provider needs to secure FFmpeg in another way, for example by restricting codecs or by running it in a container?
    - kontain 2mo ago
      The creator of borg and k8s of course already run such tools for untrusted inputs in containers, but there is also an endless stream of container escapes.
    - bijowo1676 2mo ago
      AppArmor profile is probably what you are looking for to run ffmpeg on untrusted input
    - SahAssar 2mo ago
      They claimed that this was not a problem since the codec was so uncommon, but without doing steps like removing it from the main tree or making it not built by default in major distros. I understand that from the perspective of "how many people will this crash for", but from a security perspective it is nonsensical. Even if it is an uncommon codec if the authors decide to keep the codepath there by default it is exploitable in most installs. I love ffmpeg but that whole episode left a bit of a bad taste.
  - thinkingtoilet 2mo ago
    It's all about time in the day, my friend. Do you want to secure a feature used by 100% of your users or 0.01% of your users? Which has a better ROI?
    - HelloNurse 2mo ago
      Given that it is easy to feed FFMPEG arbitrary input to exploit any vulnerability, popular codecs are very likely to be already secure enough, while unpopular ones are far more dangerous and deserve more attention. It can be assumed that an attacker would target the worst, easiest to exploit codec they can find in the whole of FFMPEG.
shoobiedoo 2mo ago
It's incredible how much it does, how quickly it does it, and how it just works every time. Whether I'm trying to deal with gigs of 4k video, embedding multiple subtitles into an mkv file, or just fiddling around with trimming a few seconds of audio off a wav, ffmpeg does it without skipping a beat.
shevy-java 2mo ago
I think most everyone agrees with that. FFmpeg is kind of a corner stone when it comes to multimedia.

I recommend watching the Lex Fridman interview with Jean-Baptiste Kempf and Kieran Kunhya. Amazing work on and amazing project.

meerita 2mo ago
It's a really good interview. I recommend it too.
hahn-kev 2mo ago
Link?
- drowntoge 2mo ago
  https://youtu.be/nepKKz-MzFM https://youtu.be/nepKKz-MzFM
  - lifestyleguru 2mo ago
    How do I pay them, do they need my money, would it help ffmpeg?
cm2187 2mo ago
Though there is one part I didn’t understand in that interview. They were complaining of being overwhelmed by AI submitted bug reports (fair), including for obscure codecs that must have been used by a couple of users at most. And therefore implying that securing those codecs is low priority/important. I don’t understand that. To me the severity has nothing to do with how popular is a code path, but whether that code path is accessible to an attacker. If I upload a specially crafted .mkv with a little known codec on YouTube and they use ffmpeg to process it, and I compromise YouTube’s infrastructure that way, it’s a pretty big deal, no matter the popularity of that codec.
- rbultje 2mo ago
  That sounds nice in theory, but it seems obvious to me there is a major discrepancy between who is burdened with this responsibility, and who benefits from the result. Given many of these contributors are unpaid volunteers, maybe the infrastructure provider needs to secure FFmpeg in another way, for example by restricting codecs or by running it in a container?
  - kontain 2mo ago
    The creator of borg and k8s of course already run such tools for untrusted inputs in containers, but there is also an endless stream of container escapes.
  - bijowo1676 2mo ago
    AppArmor profile is probably what you are looking for to run ffmpeg on untrusted input
  - SahAssar 2mo ago
    They claimed that this was not a problem since the codec was so uncommon, but without doing steps like removing it from the main tree or making it not built by default in major distros. I understand that from the perspective of "how many people will this crash for", but from a security perspective it is nonsensical. Even if it is an uncommon codec if the authors decide to keep the codepath there by default it is exploitable in most installs. I love ffmpeg but that whole episode left a bit of a bad taste.
- thinkingtoilet 2mo ago
  It's all about time in the day, my friend. Do you want to secure a feature used by 100% of your users or 0.01% of your users? Which has a better ROI?
  - HelloNurse 2mo ago
    Given that it is easy to feed FFMPEG arbitrary input to exploit any vulnerability, popular codecs are very likely to be already secure enough, while unpopular ones are far more dangerous and deserve more attention. It can be assumed that an attacker would target the worst, easiest to exploit codec they can find in the whole of FFMPEG.

shoobiedoo 2mo ago

It's incredible how much it does, how quickly it does it, and how it just works every time. Whether I'm trying to deal with gigs of 4k video, embedding multiple subtitles into an mkv file, or just fiddling around with trimming a few seconds of audio off a wav, ffmpeg does it without skipping a beat.

shevy-java 2mo ago

I think most everyone agrees with that. FFmpeg is kind of a corner stone when it comes to multimedia.