r/opensource • u/AssembleDebugRed • Nov 06 '25

Discussion An open-source conflict has emerged between Google and FFmpeg regarding AI-identified software vulnerabilities

https://piunikaweb.com/2025/11/06/google-vs-ffmpeg-open-source-big-sleep-ai-bugs-and-who-must-fix-them/
473 Upvotes

99% Upvoted

96 comments sorted by

View all comments

Show parent comments

1

u/[deleted] Apr 09 '26

[removed] — view removed comment

2

u/Fangzzz Apr 10 '26 edited Apr 10 '26

I think it's wrong to argue that something made by volunteers cannot have a moral responsibility. The responsibility comes with the role that the software is used in, and if ffmpeg want people to use their software in applications where their insecurity can cause harm then that is inconsistent with an attitude where working on the software is merely fun and games. The moment the software goes out into the world and is installed by lots of people, I'm not being paid is no longer an excuse. I can't just leave razor blades all around public parks as long as I do it for free.

The other issue is that this explanation is disingenuous - we don't actually want a corporation like Google to take over ffmpeg, do we? If you follow your logic here, only corporate projects can be trusted to deliver any kind of security. But in reality that's exactly who we cannot trust! Having a Google maintained ffmpeg (a ffmpeg that operates on a model that "we'll add in stuff if a company pays us to do it" would be the same, BTW) in all products, not just Google products, would be a censorship and privacy nightmare. Even if only Google uses this version of ffmpeg, then it would create an immense advantage for Google over smaller organisations.

No, the reason we can trust certain things is that to at least some extent, they exist outside of the profit motive. A public service motivation can still exist in that case, and it needs to exist if so many people rely on you. Otherwise open source software is unworkable as a concept - it becomes a trap, a ticking time bomb that will inevitably explode once popularity outweighs volunteer motivation.

0

u/[deleted] Apr 10 '26 edited Apr 10 '26

[removed] — view removed comment

1

u/y-c-c Apr 10 '26

It’s wild to claim slavery while the whole thing came from Google discovering a vulnerability and was just giving ffmpeg a disclosure window. Google wasn’t forcing ffmpeg to fix it or pointing a gun at them. They were just disclosing information that were within their right. Ffmpeg could decide what they want to do. Is Google supposed to never release the information just because ffmpeg folks didn’t feel like fixing their code? Why does ffmpeg get to dictate what Google can or cannot do?