NotAwfulTech and AwfulTech converged with some ffmpeg drama on twitter over the past few days starting here and still ongoing. This is about an AI generated security report by Google's "Big Sleep" (with no corresponding Google authored fix, AI or otherwise). Hackernews discussed it here. Looking at ffmpeg's security page there have been around 24 bigsleep reports fixed.

ffmpeg pointed out a lot of stuff along the lines of:

• They are volunteers
• They have not enough money
• Certain companies that do use ffmpeg and file security reports also have a lot of money
• Certain ffmpeg developers are willing to enter consulting roles for companies in exchange for money
• Their product has no warranty
• Reviewing LLM generated security bugs royally sucks
• They're really just in this for the video codecs moreso than treating every single Use-After-Free bug as a drop-everything emergency
• Making the first 20 frames of certain Rebel Assault videos slightly more accurate is awesome
• Think it could be more secure? Patches welcome.
• They did fix the security report
• They do take security reports seriously
• You should not run ffmpeg "in production" if you don't know what you're doing.

All very reasonable points but with the reactions to their tweets you'd think they had proposed killing puppies or something.

A lot of people seem to forget this part of open source software licenses:

BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW

Or that venerable old C code will have memory safety issues for that matter.

It's weird that people are freaking out about some UAFs in a C library. This should really be dealt with in enterprise environments via sandboxing / filesystem containers / aslr / control flow integrity / non-executable memory enforcement / only compiling the codecs you need... and oh gee a lot of those improvements could be upstreamed!