>Ffmpeg has no obligation to fix any of this I read this as nobody wants CVEs op... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

otherme123 9 months ago | parent | context | favorite | on: FFmpeg to Google: Fund us or stop sending bugs

>Ffmpeg has no obligation to fix any of this

I read this as nobody wants CVEs open on their product, so you might feel forced to fix them. I find it more understandable if we talk about web frameworks: Wordpress don't want security CVEs open for months or years, or users would be upset they introduce new features while neglecting safety.

I am a nobody, and whenever I found a bug I work extra to attach a fix in the same issue. Google should do the same.

vsgherzi 9 months ago [–]

Why is there an onus on Google to fix this? Bug bounty hunters aren’t required to submit a patch even when the target is open source.

Now should Google? Probably, it would be nice but no one has to. The gift from Google is the discovery of the bug.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact