OSS, security and Funding: libjpeg-turbo
I also use it during computer vision model training. Every image that goes through my model, should be decoded.
At some point I did a benchmark of python libraries that decode JPEG images https://github.com/ternaus/imread_benchmark
All top libraries use libjpeg-turbo.
The library is heavily optimized => I made a PR with a small improvement of 3%. Not groundbreaking, but small is better than nothing.
The PR was refused.
> That is not compelling enough to justify the potential disruption. Huffman decoding and partial image decompression have been the source of a disproportionate number of security issues found in the library over the years.
> Google contributed the partial image decompression feature in 2015, but I continue to have to spend unpaid hours fixing it 11 years later (including 18 unpaid hours fixing #915 a few weeks ago) while Google is ghosting me on a security patch rewards payment I earned six months ago.
> Meanwhile, the libjpeg-turbo General Fund is so far in debt that it will take until 2028 before it is replenished at the current rate of replenishment, and that assumes that I don't have to spend a lot more unpaid hours fixing newly discovered bugs.
> Playing at the margins like this unfortunately isn't a good fit for a project like libjpeg-turbo that is so heavily scrutinized and chronically underfunded.
----
I.e. Nearly everyone who uses internet uses libjpeg-turbo every day, but very impactful work goes unpaid.
P.S. Looked for a way to donate some money via GitHub sponsors, but did not find such an option.
P.P.S. And now, when rewriting other people's software with LLMs became easy... Long live OSS.