223
FFmpeg to Google: Fund Us or Stop Sending Bugs (thenewstack.io)
submitted 10 months ago by to c/foss@beehaw.org
50 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 22 points 10 months ago* (2 children)

The issue is not whether security issues exist in ffmpeg. It's clear that vulnerabilities need to be fixed.

The issue is with who actually fixes them. Your last sentence is the core of it. Google can submit as many bug reports as they want, but they better be willing to ensure the bugs get fixed too.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 10 months ago (1 child)

    Google having found the bugs can either submit bug reports or quietly sit on them, or even exploit them as spyware, among other ideas. Whether they fund ffmpeg is a completely separate question. I can see how the 90 day disclosure window can be a problem if the number of reports is high.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 11 points 10 months ago (1 child)

    Bug reports that apply only to Google's services or which surface only because of them are bugs Google needs to fix. They can and do submit bug reports all they want. Nobody is obligated to fix them.

    The other part of this is, of course, disclosure. Google's disclosure of these bugs discredits ffmpeg developers and puts the blame on them if they fail to fix the vulnerabilities. They can acknowledge the project as being a volunteer, hobby project created by others if they want, and they can treat it like that. But if they're doing that, they should not be putting responsibilities on them.

    If Google wants to use ffmpeg, they can. But a bug in ffmpeg that affects Google's services is a bug in Google's service. It is not the responsibility of unpaid volunteers to maintain their services for them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 10 months ago* (1 child)

    I don't understand how a bug is supposed to know whether it's triggered inside or outside of a google service. If the bug can only be triggered in some weird, google-specific deployment, that's one thing, but I don't think that's what we're talking about here. If the bug is manifestly present in ffmpeg and it's discovered at google, what are you saying is supposed to happen? Google should a) report it under the normal 90 day disclosure rule; b) report it but let it stay undisclosed for longer than normal, due to the resource contraints ffmpeg's devs areunder; c) not report it and let some attacker exploit it? (b) might have some merit but (c) is insane. Once some bad actor finds out about the bug (through independent discovery or any other way), it's going to be exploited. That might already be happening before even google finds the bug.

    FFmpeg's codebase and dev community are both exceptionally difficult and that is not helping matters, I'm sure.

    There are a bunch of Rust zealots busily rewriting GNU Coreutils which in practice have been quite reliable and not that badly in need of rewriting. Maybe the zealots should turn their attention to ffmpeg (a bug minefield of long renown) instead.

    Alternatively (or in addition), some effort should go into sandboxing ffmpeg so its bugs can be contained.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 8 points 10 months ago* (1 child)

    I don't understand how a bug is supposed to know whether it's triggered inside or outside of a google service.

    Who found the bug, and what triggered it? Does it affect all users, or does it only affect one specific service that uses it in one specific way due to a weird, obscure set of preconditions or extraordinarily uncommon environment configuration?

    Most security vulnerabilities in projects this heavily used are hyper obscure.

    If the bug is manifestly present in ffmpeg and it's discovered at google, what are you saying is supposed to happen?

    e) Report it with the usual 90 day disclosure rule, then fix the bug, or at least reduce the burden as much as possible on those who do need to fix it.

    Google is the one with the vulnerable service. ffmpeg itself is a tool, but the vast majority of end users don't use it directly, therefore the ffmpeg devs are not the ones directly (or possibly at all) affected by the bug.

    There are a bunch of Rust zealots busily rewriting GNU Coreutils which in practice have been quite reliable and not that badly in need of rewriting. Maybe the zealots should turn their attention to ffmpeg (a bug minefield of long renown) instead.

    This is weirdly offtopic, a gross misrepresentation of what they are doing, and horribly dismissive of the fact that every single person being discussed who is doing the real work is not being paid support fees by Google. Do not dictate what they should do with their time until you enter a contract with them. Until that point, what they do is none of your business.

    Alternatively (or in addition), some effort should go into sandboxing ffmpeg so its bugs can be contained.

    And who will do this effort?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •