Though there is one part I didn’t understand in that interview. They were complaining of being overwhelmed by AI submitted bug reports (fair), including for obscure codecs that must have been used by a couple of users at most. And therefore implying that securing those codecs is low priority/important.

I don’t understand that. To me the severity has nothing to do with how popular is a code path, but whether that code path is accessible to an attacker. If I upload a specially crafted .mkv with a little known codec on YouTube and they use ffmpeg to process it, and I compromise YouTube’s infrastructure that way, it’s a pretty big deal, no matter the popularity of that codec.

▲

beltsazar 3 minutes ago | parent | next [-]

[delayed]

▲

rbultje 3 hours ago | parent | prev | next [-]

That sounds nice in theory, but it seems obvious to me there is a major discrepancy between who is burdened with this responsibility, and who benefits from the result. Given many of these contributors are unpaid volunteers, maybe the infrastructure provider needs to secure FFmpeg in another way, for example by restricting codecs or by running it in a container?

	▲	kontain 3 hours ago \| parent [-]
		The creator of borg and k8s of course already run such tools for untrusted inputs in containers, but there is also an endless stream of container escapes.

▲

thinkingtoilet 2 hours ago | parent | prev [-]

It's all about time in the day, my friend. Do you want to secure a feature used by 100% of your users or 0.01% of your users? Which has a better ROI?

▲

HelloNurse an hour ago | parent | next [-]

Given that it is easy to feed FFMPEG arbitrary input to exploit any vulnerability, popular codecs are very likely to be already secure enough, while unpopular ones are far more dangerous and deserve more attention. It can be assumed that an attacker would target the worst, easiest to exploit codec they can find in the whole of FFMPEG.

▲

jobigoud an hour ago | parent | prev [-]

It's used by most users, that's what they are saying, it doesn't matter that the file format is obscure.

If you make a video player based on ffmpeg you take input videos. The attacker can share a specially crafted video with the victim. Same kind of attack as sharing word documents.

	▲	luckydata an hour ago \| parent [-]
		when it comes to security popularity doesn't matter all that much. If something is not used and insecure then the decision should be to drop the feature, not to ignore the security issue.