sjvnNov 11

FFmpeg to Google Fund Us or Stop Sending Bugs: https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/ by @sjvn

The clash between small volunteer-driven, open-source projects, such as FFmpeg & the billion-dollar companies built on their work, which demand rapid security patches, is heating up.

FFmpeg to Google: Fund Us or Stop Sending Bugs

A lively discussion about open source, security, and who pays the bills has erupted on Twitter. 

The New Stack
Show threadWolf480plNov 11

@sjvn I think it's unclear what's preventing ffmpeg devs from just ignoring these bug reports.

Like, if GPZ were to publish the details of an unfixed vuln in a rarely-used feature of ffmpeg, there shouldn't be much impact on real users, most of the pain would be with the CVE-obsessed corpos that use ffmpeg in their products, right?

Show threadHaelwenn /элвэн/ Nov 11
@wolf480pl @sjvn I'd guess there's a lot of CVE-obsessed corpos, so it amplifies the spam about useless CVEs.
After all there's often the box ticking thing of "Zero known CVEs with this version number", which is bullshit but that's corporate for you.
Show threadWolf480plNov 11

@lanodan @sjvn
Right, so they'd have to survive a wave of corpos asking about the CVE and tell all of them to send a patch or gtfo....

Maybe they could create an issue on their issue tracker with the details of the vuln, and info why it's not a priority and that they lack resources to fix it.

Then send all the angry corpos a link to that issue, and disable notifications.

Show threadWolf480plNov 11

@lanodan @sjvn
I see three possible outcomes:
- the corpos eventually make a patch
- the corpos fork ffmpeg
- the corpos remove ffmpeg from all of their products

I don't think any of those would be tragic, though getting there might be painful :/

Show threadjan Ki | 奇  
@wolf480pl @lanodan @sjvn
the fourth possible outcome:
- the corpos "recreate" ffmpeg as a closed source alternative using LLMs
Nov 12 at 7:17amWeb
Show threadWolf480plNov 12
@ki
ffmpeg is not AGPL, they can always make a private fork and not tell anyone, no need to wash i through LLMs
@lanodan @sjvn
Show threadjan Ki | 奇  Nov 12
@wolf480pl
there's never a need for LLMs, but corpos love them
Show threadsjvnNov 12
@wolf480pl @ki @lanodan FFmpeg would be very hard to fork for one simple reason: It's largely written in assembly language.