GabrielTFS

vorige maanddiscuss

The issue with strncpy is that it doesn't actually necessarily terminate - in fact in any case where the source is larger than the destination it will just leave it unterminated (like, it will copy the last character it can from the source instead of terminating the destination string with a NUL)

GabrielTFS

5 maanden geledendiscuss

Oh oops, my apologies :(

GabrielTFS

5 maanden geledendiscuss

Sad news. I wonder if his projects (e.g. dietlibc) will continue development or not...

GabrielTFS

6 maanden geledendiscuss

> If this much effort were being put into writing about government policy I'd totally agree with you, but this level of detail is uncharacteristic even for Wikipedia.

Honestly, I think you're very much underestimating how much Wikipedia writes about government policy - but perhaps more to the point, it's trivial to find articles about controversies regarding the "other side" that are also quite well furnished, e.g.:

- https://en.wikipedia.org/wiki/Barack_Obama_tan_suit_controve...

- https://en.wikipedia.org/wiki/Let%27s_Go_Brandon

- https://en.wikipedia.org/wiki/I_Did_That!

- https://en.wikipedia.org/wiki/2023_White_House_cocaine_incid...

- https://en.wikipedia.org/wiki/Township_High_School_District_...

- https://en.wikipedia.org/wiki/Code_name_Geronimo_controversy

So I don't think there's much of an argument to say that they're being particularly biased in doing this (you might believe that none, or almost none of these articles at all should exist, but that's a different issue).

GabrielTFS

7 maanden geledendiscuss

Moving away from Program Files would cost far more than it's worth - it'd cause lots of issue for a massive amount of users and be of very little value for others, when the only practical issue with the Steam folder being in Program Files right now is people going "oh I didn't expect that directory to be writable I guess" which is not something worth spending a bunch of time orchestrating a massive transition over.

GabrielTFS

7 maanden geledendiscuss

#include also searches for the file you give it in an "implementation-defined manner", so if you have this complaint about #embed, you ought to also consider #include equally problematic

GabrielTFS

7 maanden geledendiscuss

They would generally need to convert to fiat to do something useful, yes, but 501 (c) (3) nonprofits generally don't pay capital gains tax, no.

GabrielTFS

8 maanden geledendiscuss

Very minor nitpick but I'd have said France went through four different monarchic systems in that time frame (1776-1790 Ancient Régime, 1791-1792 Constitutional monarchy, 1814-1830 Bourbon Restoration and 1830-1848 July Monarchy)

GabrielTFS

8 maanden geledendiscuss

If Google wanted nothing more than to simply make blog posts, why wouldn't they just only report the big bugs that they can make blog posts out of (and avoid having to spend any resources on finding the rest) ?

I don't know if you'd be satisfied with that, but certainly this would allow them to easily make the blog posts you seem to be complaining about, all while making the load on maintainers rather minimal, at least insofar as blog posts appear to be quite infrequent compared to the total amount of vulnerabilities they report - around 20 vulnerability reports per year certainly seems like a manageable load for the entire FOSS community to bear, especially given almost none of these 20 yearly vulnerability reports would go to ffmpeg (if not literally none, given the Project Zero blog has 0 search results for "ffmpeg" or "libav"), and a significant portion of their blog posts aren't even about FOSS at all but instead about proprietary software like the operating systems Microsoft and Apple make.

I do think such a thing would be bad for everyone, though (including the ffmpeg developers themselves, to be honest) - Project Zero is good for everyone's security, in my opinion, and even if all FOSS developers were to universally decide to reject all Project Zero reports that don't come with a patch, and Google decided to still not make such patches, people being able to know that these vulnerabilities exist is still a good thing nonetheless - certainly much better than more vulnerabilities being left in for malicious actors to discover and use in zero-day attacks.

GabrielTFS

8 maanden geledendiscuss

In practice, it doesn't matter all that much whether the software project containing the vulnerability has the resources to fix it: if a vulnerability is left in the software, undisclosed to the public, the impact to the users is all the same.

I, and I think most security researchers do too, believe that it would be incredibly negligent for someone who has discovered a security vulnerability to allow it to go unfixed indefinitely without even disclosing its existence. Certainly, ffmpeg developers do not owe security to their users, but security researchers consider that they have a duty to disclose them, even if they go unfixed (and I think most people would prefer to know an unfixed vulnerability exists than to get hit by a 0-day attack). There's gotta be a point where you disclose a vulnerability, the deadline can never be indefinite, otherwise you're just very likely allowing 0-day attacks to occur (in fact, I would think that if this whole thing never happened and we instead got headlines in a year saying "GOOGLE SAT ON CRITICAL VULNERABILITY INVOLVED IN MASSIVE HACK" people would consider what Google did to be far worse).

To be clear, I do in fact think it would be very much best if Google were to use a few millionths of a percent of their revenue to fund ffmpeg, or at least make patches for vulnerabilities. But regardless of how much you criticize the lack of patches accompanying vulnerability reports, I would find it much worse if Google were to instead not report or disclose the vulnerability at all, even if they did so at the request of developers saying they lacked resources to fix vulnerabilities.

GabrielTFS

8 maanden geledendiscuss

Full (immediate) disclosure, where no time is given to anyone to do anything before the vulnerability is publicly disclosed, was historically the default, yes. Coordinated vulnerability disclosure (or "responsible disclosure" as many call it) only exists because the security researchers that practice it believe it is a more effective way of minimizing how much the vulnerability might be exploited before it is fixed.

GabrielTFS

8 maanden geledendiscuss

A solution definitely ought to be found. Google putting up a few millionths of a percent of their revenue or so towards fixing the bugs they find in ffmpeg would be the ideal solution here, certainly. Yet it seems unlikely to actually occur.

I think the far more likely result of all the complaints is that Google simply completely disengages from ffmpeg and stops doing any security work on it. I think that would be quite bad for the security of the project - if Google can trivially find bugs at a high speed such that it overwhelms the ffmpeg developers, I would imagine bad actors can also search for them and find those same vulnerabilities Google is constantly finding, and if they know that those vulnerabilities very much exist, but that Google has simply stopped searching for them upon demand of the ffmpeg project, this would likely give them extremely high motivation to go looking in a place they can be almost certain they'll find unreported/unknown vulnerabilities in. The result would likely be a lot more 0-day attacks involving ffmpeg, which I do not think anyone regards as a good outcome (I would consider "Google publishes a bunch of vulnerabilities ffmpeg hasn't fixed so that everyone knows about them" to be a much preferable outcome, personally)

Now, you might consider that possibility fine - after all, the ffmpeg developers have no obligation to work on the project, and thus to e.g. fix any vulnerabilities in it. But if that's fine, then simply ignoring the reports Google currently makes is presumably also fine, no ?

GabrielTFS

9 maanden geledendiscuss

Empirical evidence appears to show that it is ¯\_(ツ)_/¯

GabrielTFS

9 maanden geledendiscuss

Do you find no one at all being able to access the bug tracker to be preferable to "getting delays and errors" ?

GabrielTFS

9 maanden geledendiscuss

I would guess a significant portion of people using the style (if not most), did so inspired by Windows, though

GabrielTFS

vorig jaardiscuss

Can someone explain what's the big idea with that ? I keep seeing conspiracy theories about how Red Hat is sabotaging the Linux desktop on purpose, but I would quite honestly like to see an explanation as to *why* Red Hat would do that.

GabrielTFS

vorig jaardiscuss

This seems like a poor argument. I don't like much either having the obligation to give GitHub my phone number, but it's not the same thing as a social security number, now is it ? Would you argue otherwise ?

GabrielTFS

vorig jaardiscuss

That's the generic implementation - it's not used on most popular architectures (I think the most popular architecture it's used on would be RISC-V or MIPS) because they all have architecture-specific implementations. The implementation running on the average (x86) computer is likely to be https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86... (if you have AVX512), https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86... (if you have AVX2 and not AVX512) or https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86... (if you have neither AVX2 nor AVX512 - rather rare these days)

GabrielTFS

vorig jaardiscuss

Sonic Advance 2 might be late enough that developers started to take that seriously, e.g. I recall hearing that earlier games like Ocarina of Time already were being developed using CVS, for instance, and another game from around that time that I specifically recall would be Pokemon Diamond & Pearl, developed in an SVN repository

GabrielTFS

vorig jaardiscuss

SEGA seems to always have been a lot more generous with this kind of thing... Much of the disassembly or decompilation projects I've seen come out of old SEGA games include all the assets with them (e.g. look up disassemblies for the Genesis games), and ROM hacks are typically distributed as full ROMs - I've basically never seen SEGA use the DMCA against any disassemblies/decompilations/ROM hacks.

comments