Programming

17496 readers

40 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Follow the programming.dev instance rules
Keep content related to programming in some way
If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities [email protected]

founded 1 year ago

MODERATORS

[email protected]

1057

Microsoft opens a "high priority" bug ticket in ffmpeg, attempting to leech the free labour of the maintainers (trac.ffmpeg.org)

submitted 7 months ago* (last edited 7 months ago) by [email protected] to c/[email protected]

228 comments fedilink hide all child comments

Microsoft employee:

Hi, This is a high priority ticket and the FFmpeg version is currently used in a highly visible product in Microsoft. We have customers experience issues with Caption during Teams Live Event. Please help

Maintainer's comment on twitter:

After politely requesting a support contract from Microsoft for long term maintenance, they offered a one-time payment of a few thousand dollars instead.

This is unacceptable.

And further:

The lesson from the xz fiasco is that investments in maintenance and sustainability are unsexy and probably won't get a middle manager their promotion but pay off a thousandfold over many years.

But try selling that to a bean counter

you are viewing a single comment's thread
view the rest of the comments

[+] [email protected] -6 points 7 months ago (2 children)

Does that go for the xz vulnerability too? Wasn't it a Microsoft dev who discovered that?

[–] [email protected] 14 points 7 months ago

In this case, it's actually Microsofts fault. There is no bug in ffmpeg, Microsoft just didn't properly use it

[–] [email protected] 0 points 7 months ago

the xz vulnerability was done through a superflous dependency to systemd, xz was only the library that was abused to use systemd's superflous dependency hell. sshd does not use xz, but systemd does depend on it. sshd does not need systemd, but it was attacked through its library dependency.

we should remove any pointless dependencies that can be found on a system to prevent such attacks in future by reducing dependency based attack vectors to a minimum.

also we should increase the overall level of privilege separation where systemd is a good bad example, just look at the init binary and its capability zoo.

The company who hired "the" systemd developer should IMHO start to really fix these issues !

so please hold your "$they have fixed it" back until the the root cause that made the xz dependency level attack possible in the first place has been really fixed =)

Of course pointing it out was good, but now the root cause should be fixed, not just a random symptom that happened to be the first visible atrack that used this attack vector introduced by systemd.