FFmpeg to Google: Fund Us or Stop Sending Bugs 🔗 **Source:** [FFmpeg to Google: Fund Us or Stop Sending Bugs](https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/) > [!note]+ Document Notes > tags: [open-source, security-disclosure, funding] > author: Steven J. Vaughan-Nichols > source: The New Stack > reference: [https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/] > date created: 2025-11-12 00:00 > > # 🏷️ Title: FFmpeg to Google: Fund Us or Stop Sending Bugs > <!-- deep-read:sections start --> ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - Include links cited in or relevant to the article. ## 📝 Summary - What happened: FFmpeg called out Google for AI-driven CVE reports without funding or patches, after an obscure Smush codec bug triggered pressure under Google Project Zero’s disclosure clock. - Why it matters: Critical, volunteer-maintained infrastructure like FFmpeg and libxml2 face unsustainable security workload without compensation. - Key stakeholders: FFmpeg maintainers; Google/Project Zero; Chainguard (Dan Lorenc); broader OSS ecosystem; downstream users (browsers, YouTube, streaming platforms). - Risks and tradeoffs: Faster disclosure vs. maintainer burnout; AI-found “CVE slop” vs. real risk reduction; public safety vs. underfunded upstreams. - Bottom line: Responsible disclosure needs responsible funding; large beneficiaries should resource upstream or ship patches with reports. ## 📖 Main Content - Core arguments: - FFmpeg is widely embedded (Chrome, Firefox, YouTube, VLC) yet “written almost exclusively by volunteers.” - Google’s transparency policy starts the 90-day clock within a week of report acknowledgment, regardless of maintainer capacity. - AI-generated vulnerability floods can overwhelm projects with low-impact issues, consuming scarce expert time (often assembly-level work). - Maintainer exits (e.g., libxml2) signal systemic sustainability failure. - Context/definitions: - CVE: standardized identifier for security vulnerabilities. - Responsible disclosure: coordinated reporting with remediation windows. - “CVE slop”: low-impact, high-volume issues diluting attention. - Uncertainties/contested claims: - The net value of AI-found low-severity bugs. - Sufficiency of existing programs (e.g., Patch Rewards limits). ### 🗒️ Notes - FFmpeg libraries (libavcodec, libavformat) underpin major media stacks. - Trigger: Google AI found a medium-impact issue affecting initial frames of a 1995 game codec (Smush/Rebel Assault 2); FFmpeg patched it but called the pattern “CVE slop.” - FFmpeg: “security issues are taken extremely seriously,” but fixes are by volunteers. - Maintainer burden parallels libxml2’s resignation citing weekly hours on third-party reports. - GPZ policy: announces reports within a week; 90-day clock starts; maintainers view this as unfair pressure. - Patch Rewards criticized as too limited (e.g., three patches/month). - Dan Lorenc: disclosure is a contribution to the commons; Google supports OSS broadly; public debates may deter sponsors. - Article’s thrust: without corporate support proportional to reliance, critical OSS may be abandoned, increasing systemic risk. ## 📚 References - FFmpeg to Google: Fund Us or Stop Sending Bugs (The New Stack): https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/ - Google Project Zero reporting transparency trial (blog): https://googleprojectzero.blogspot.com/2024/07/reporting-transparency.html - FFmpeg project (homepage): https://ffmpeg.org/ - libxml2 maintainership change discussion (GitLab/GNOME issue): https://gitlab.gnome.org/GNOME/libxml2/-/issues - Google Patch Rewards Program: https://bughunters.google.com/patch-rewards/ - Dan Lorenc (Chainguard) profile/context: https://www.chainguard.dev/about ## 🗣️ Paraphrase - Paragraph A: FFmpeg argues that trillion-dollar firms using its code should either provide fixes with vulnerability reports or fund maintainers, especially when AI generates many low-value CVEs. - Paragraph B: Google and some security researchers contend rapid, transparent disclosure strengthens the commons, but maintainers warn the current model is unsustainable without upstream investment. ## 📰 Newsletter - In this week’s open source watch: FFmpeg publicly urged Google to pair AI-found CVEs with funding or patches. With libxml2’s maintainer stepping back, it’s a wake-up call for projects embedded in browsers, clouds, and media stacks. If you ship FFmpeg, audit your dependency posture and budget upstream support. Resources: Google Project Zero’s reporting policy, FFmpeg’s contribution guide, and Patch Rewards. Consider aligning security SLAs with funding commitments and adding “patch-with-report” practices in your org. ## ✅ Action Items #### DevRel - Publish guidance: “Patch-with-report” playbook; sample PRs for upstream CVEs. - Run office hours with FFmpeg/libxml2 maintainers; record demos on reproducing and fixing codec bugs. - Build quickstarts for fuzzing harnesses; add CI examples. #### OSPO - Establish upstream funding policy tied to dependency criticality. - Define vuln intake + embargo alignment with upstream timelines. - Maintain SBOMs; set freshness SLOs and owner maps. #### Community - Maintainers: set triage policies, severity thresholds, rate limits. - Contributors: first-issue rotations to reduce maintainer toil. - Sponsors: publish budgets, milestones, and impact reports; fund maintainer time. #### WordPress - Core/Performance: track media pipeline deps (FFmpeg), set perf/security budgets. - Training/Docs: add dependency handling and upstream contribution guides. - Security/Meta: coordinated disclosure runbooks and telemetry for media parsing issues. #### The WPOCC - Launch maintainer stipends and matched grants for critical deps. - Run governance clinics and disclosure drills. ### FAIR - Require provenance/signature checks; publish funding transparency and sunset clauses. - Standardize contribution charters and operator agreements. ## 🧪 Hypotheses - Funding tied to dependency criticality reduces time-to-fix for CVEs. - Patch-with-report reduces maintainer burnout vs. report-only. - AI triage plus severity gating cuts “CVE slop” without raising risk. - Transparency policies without funding increase maintainer attrition. ### 📊 Methodology - Quasi-experiment across projects: introduce patch-with-report; measure MTTR, maintainer hours, attrition. - Compare AI triage models with/without severity thresholds. - Survey maintainers on workload, stress, and perceived fairness. ### ❓ Questions - What funding models scale for critical but unmonetized libraries? - How to calibrate AI bug-finding to project capacity and risk? - Should disclosure clocks flex for volunteer-only projects? ### 🔮 Future Research - Optimal thresholds for auto-reporting AI-found issues. - Market mechanisms for dependency insurance or pooled funding. - Standardized upstream SLAs for large consumers. ### 💡 Implications - Practice: pair vulnerability reports with minimal viable patches. - Policy: link disclosure timelines to maintainer capacity. - Security: prioritize high-impact issues; rate-limit low-severity floods. - Funding: mandate upstream line items for critical deps. ### 🧠 Learning Styles Assessment - Reading level: Flesch-Kincaid Grade ~10–11. #### 👀 Visual learners - Improve: add data flow of disclosure → triage → fix; maintainer workload charts. #### 🔊 Aural learners - Improve: 3-minute audio summary with key quotes. #### 🗣️ Verbal learners - Present: clear definitions (CVE, responsible disclosure). - Improve: more analogies and side-by-side term comparisons. #### 🧩 Kinesthetic learners - Improve: hands-on lab to reproduce and patch a sample codec bug. #### 🧠 Logical learners - Improve: decision trees for report acceptance and severity gating. #### 🧑‍🤝‍🧑 Social learners - Improve: moderated Q&A with maintainers and security engineers. #### 🧘‍♀️ Solitary learners - Improve: self-check quiz on disclosure policies and funding options. #### 🌿 Naturalistic learners - Improve: ecosystem mapping of dependencies and sustainability cycles. ### 📊 Accessibility Assessment #### Screen reader semantics - Improve: ensure descriptive alt text for diagrams; language attributes. #### Keyboard navigation - Improve: verify tab order and remove focus traps in any shared tools. #### Contrast and readability - Improve: enforce 4.5:1 contrast; check line-height and spacing. #### Text resizing and reflow - Improve: support 200% zoom with no clipping; respect reduced motion. #### Media and captions - Improve: provide transcripts and audio descriptions; no autoplay. #### Forms and interactions - Improve: clear labels, inline validation, sufficient target sizes. #### Standards reference - Map gaps to WCAG 2.2 AA. ### 🌍 DEIB Assessment #### Cultural breadth - Improve: global maintainer perspectives and multilingual resources. #### Inclusive language - Present: largely neutral; jargon defined. - Improve: plain-language summaries and glossary expansion. #### Neurodiversity support - Improve: consistent structure, icon+text labels. #### Representation - Improve: balanced quotes from diverse maintainers. #### Psychological safety - Improve: community guidelines and escalation paths in disclosure threads. ### ✅ Logical Validity #### Strong reasoning - Inductive: Maintainer exit (libxml2) supports claim of unsustainability. - Causal: AI-driven volume → maintainer toil → burnout risk. #### Fallacies - Potential hasty generalization from specific Smush case; fix by adding broader data. #### Tone of voice - Concerned, pragmatic, advocacy-oriented. ### 🛡️ DARVO Analysis - Deny: Implicit minimization of burden risk in pro-transparency stance. - Attack: Limited; some framing of “complaining” countered by practical limits of Patch Rewards. - Reverse victim/offender: Tension over casting reporters as helpers vs. burdening volunteers. ## 🎯 Conclusion - Bottom line: Disclosure without resourcing is brittle. Large beneficiaries should fund upstream and ship patches with reports to sustain critical OSS. - Next steps: Adopt patch-with-report norms, create upstream funding SLAs, calibrate AI triage, and coordinate disclosure timelines with maintainer capacity. ## 🧱 Refactor Appendix (append after 🎯 Conclusion) ### 📚 Literature Split Pad - Purpose: Stage Konik CEE units that become per-source Literature notes. - Split level: H3. - Include verbatim quotes under 25 words and a [view highlight] link. ### [H1] 5–10-word present-tense claim > [!quote] [FFmpeg to Google: Fund Us or Stop Sending Bugs](https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/) by [[Steven J. Vaughan-Nichols]] via [[The New Stack]]. Published 2025-11-11. Accessed 2025-11-12. > “FFmpeg is written almost exclusively by volunteers.” Two lines: context and use. Cite data if relevant. [view highlight](https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/#H1) #xref #articleseed ID:rw_[MISSING] ### [H2] 5–10-word present-tense claim > [!quote] [FFmpeg to Google: Fund Us or Stop Sending Bugs](https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/) > “GPZ starts the 90-day clock within a week.” Two lines: context and use. [view highlight](https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/#H2) #xref ID:rw_[MISSING] --- ### 🔖 Atomic Split Pad (Zettel Candidates) - Purpose: Promote reusable claims into Atomic notes. - Split level: H4. - Each item: one idea, present tense, specific, testable. #### [Z1] Patch-with-report reduces maintainer toil - Applies to high-dependency, volunteer-run projects. - Pointer: FFmpeg debate; GPZ policy. - Links: [[Upstream-Funding]] [[Responsible-Disclosure]] #### [Z2] AI-severity gating preserves maintainer capacity - Condition: triage thresholds and rate limits enforced. - Pointer: “CVE slop” discussion. - Links: [[AI-Triage]] [[Security-Operations]] --- ### ✏️ Fleeting Queue (Extract by Selection) - [F1] Draft “patch-with-report” internal policy — context/thenewstack.io #fleeting #inbox - [F2] Map top 10 deps to funding plan — context/thenewstack.io #fleeting #inbox - [F3] Design AI triage severity gates — context/thenewstack.io #fleeting #inbox --- <!-- deep-read:sections end -->