Hacker News Reader

Comment by ivell | Hacker News Reader

Irrespective of what Google does, security research is still useful for all of us.

They could adopt a more flexible policy for FOSS though.

Or they could contribute solutions to said bugs? Its not like they would distract that much from their bottom line

Exactly. The call-out is not "please stop doing security research". It is, "if you have a lot of money to spend on security research, please spend some of it on discovering the bugs, and some on fixing them (or paying us to fix them), instead of all of it on discovering bugs too fast for us to fix them in time".

Google is a major contributor to open-source video, to the point where it would not be viable without them.

Is it? I’ve gotten nothing but headaches from these automated CVE-seeking teams.

You got lower chances of getting hacked by a random file on the internet. At Project Zero level they're also not CVE seeking - it doesn't even matter at that scale, it's not an independent trying to become known.

I have yet to see one on any project I’ve been attached to that was actually exploitable under real circumstances. But the CVE hunting teams treat them all as if they were.

You should honestly consider not responding if you are unaware of Project Zero.

TFA is about Project Zero getting uppity about an unexploitable non-issue in ffmpeg.

Project Zero hasn't reported any vulnerabilities in any software I maintain. Lots of other security groups have, some well respected as well, but to my knowledge none of these "outside" reports were actual vulnerabilities when analyzed in context.

You are welcome to view the report however you like, but a world where an easily reproducible OOB read and UAF in the default configuration is an "unexploitable non-issue" is not reality.

For a codec that isn't configured by default, and only used and maintained by a hobbyist video game content preservation group. Yeah it's a non-issue.

> a codec that isn't configured by default

Where did you get that idea?

It's used by exploit authors, too.

It's as useful as brute forcing one of your neighbor's 100 online passwords every day and writing it on the door of a random supermarket.

Reply on news.ycombinator.com