https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/

TNS
OK
SUBSCRIBE
Join our community of software engineering leaders and aspirational
developers. Always stay in-the-know by getting the most important
news and exclusive content delivered fresh to your inbox to learn
more about at-scale software development.
EMAIL ADDRESS
REQUIRED
[                    ] SUBSCRIBE
RESUBSCRIPTION REQUIRED
 
It seems that you've previously unsubscribed from our newsletter in
the past. Click the button below to open the re-subscribe form in a
new tab. When you're done, simply close that tab and continue with
this form to complete your subscription.
RE-SUBSCRIBE
The New Stack does not sell your information or share it with
unaffiliated third parties. By continuing, you agree to our Terms of
Use and Privacy Policy.
Welcome and thank you for joining The New Stack community!
Please answer a few simple questions to help us deliver the news and
resources you are interested in.
FIRST NAME
REQUIRED
[                    ]
LAST NAME
REQUIRED
[                    ]
COMPANY NAME
REQUIRED
[                    ]
COUNTRY
REQUIRED
[Select ...                                  ]
ZIPCODE
REQUIRED
[                    ]
Great to meet you!
Tell us a bit about your job so we can cover the topics you find most
relevant.
What is your job level?
REQUIRED
[Select ...                              ] [                    ]
Which of these most closely describes your job role?
REQUIRED
[Select ...                           ] [                    ]
How many employees are in the organization you work with?
REQUIRED
[Select ...      ]
What option best describes the type of organization you work for?
REQUIRED
[Select ...                                                                                                 ]
[                    ]
Which of the following best describes your organization's primary
industry?
REQUIRED
[Select ...                                           ]
[                    ]
LINKEDIN PROFILE URL
 
[                    ]
Welcome!

We're so glad you're here. You can expect all the best TNS content to
arrive Monday through Friday to keep you on top of the news and at
the top of your game.

What's next?

Check your inbox for a confirmation email where you can adjust your
preferences and even join additional groups.

Follow TNS on your favorite social media networks.

        

Become a TNS follower on LinkedIn.

Check out the latest featured and trending stories while you wait for
your first TNS newsletter.

PREV
1 of 2
NEXT
VOXPOP
As a JavaScript developer, what non-React tools do you use most
often?

Angular
0%

Astro
0%

Svelte
0%

Vue.js
0%

Other
0%

I only use React
0%

I don't use JavaScript
0%
Thanks for your opinion! Subscribe below to get the final results,
published exclusively in our TNS Update newsletter:
[                    ]
SUBMIT
 
 
NEW! Try Stackie AI
ARCHITECTURE
Cloud Native Ecosystem Containers Databases Edge Computing 
Infrastructure as Code Linux Microservices Open Source Networking 
Storage
ENGINEERING
AI AI Engineering API Management Backend development Data Frontend
Development Large Language Models Security Software Development 
WebAssembly
OPERATIONS
AI Operations CI/CD Cloud Services DevOps Kubernetes Observability 
Operations Platform Engineering
PROGRAMMING
C++ Developer tools Go Java JavaScript Programming Languages Python 
Rust TypeScript
CHANNELS
Podcasts Ebooks Events Webinars Newsletter TNS RSS Feeds
THE NEW STACK
About / Contact Sponsors Advertise With Us Contributions
PODCASTS EBOOKS EVENTS WEBINARS NEWSLETTER CONTRIBUTE
ARCHITECTURE ENGINEERING OPERATIONS PROGRAMMING
Cloud Native Ecosystem Containers Databases Edge Computing 
Infrastructure as Code Linux Microservices Open Source Networking 
Storage
Migrating VMs to Kubernetes: A Roadmap for Cloud Native Enterprises
Nov 3rd 2025 5:07am, by Janakiram MSV
Can the 50-Year-Old Actor Model Rescue Agentic AI?
Oct 22nd 2025 7:47am, by Kimberley Mok
OpenSearch 3.3's New AI Agents Now Generally Available for Developers
Oct 16th 2025 12:00pm, by Steven J. Vaughan-Nichols
Crossing the AI Chasm: Lessons From the Early Days of Cloud
Oct 9th 2025 7:00am, by Randy Bias
OpenStack Flamingo Reduces Technical Debt, Boosts Performance
Oct 7th 2025 11:00am, by Steven J. Vaughan-Nichols
Practitioners' Guide to Chiseled Containers: Smaller, Faster, Safer
Nov 10th 2025 6:00am, by Pankaj Gupta
Monitor Docker Containers Across Servers With Beszel
Nov 7th 2025 2:00pm, by Jack Wallen
Apptainer for Docker Developers: A Comprehensive Guide
Nov 7th 2025 6:00am, by Janakiram MSV
How To Deploy a Local AI via Docker
Oct 23rd 2025 11:00am, by Jack Wallen
Are Unikernels the Answer for Next-Gen AI Cloud Workloads?
Oct 23rd 2025 7:00am, by Joab Jackson
How Distributed Databases Power Developer Platforms at Scale
Nov 10th 2025 12:00pm, by Gaurav Saxena
Exploring RTEB, a New Benchmark To Evaluate Embedding Models
Nov 10th 2025 10:00am, by Thibaut Gourdel
Why SAP Is Opening Up Its Data and Developer Ecosystems
Nov 10th 2025 9:00am, by Frederic Lardinois
Search Isn't Dead: From RAG to Agents With Vector Databases
Nov 7th 2025 2:30pm, by Vicki Walker
Reinventing PostgreSQL for the Next Generation of Apps
Nov 6th 2025 12:00pm, by Chris J. Preimesberger
The AI Inflection Point Isn't in the Cloud, It's at the Edge
Oct 26th 2025 8:00am, by Alex Williams
Right-Sizing AI for the Edge: Power, Models and Security
Oct 9th 2025 10:00am, by Chris J. Preimesberger
Why the Edge Isn't Just 'Cloud Computing, But Closer'
Sep 16th 2025 9:00am, by Charles Humble
Kubernetes at the Edge: Deploy With Confidence and Control
Aug 19th 2025 10:00am, by Vicki Walker
Scaling AI Inference at the Edge With Distributed PostgreSQL
Jul 21st 2025 9:00am, by Meredith Shubel
Build Terraform Modules That Your Team Will Actually Reuse
Nov 7th 2025 10:00am, by Rak Siva
Pulumi's AI Agent Tackles Infrastructure Compliance Backlogs
Nov 5th 2025 6:00am, by Darryl K. Taft
Project infragraph: IBM's Real-Time Model for Infrastructure Assets
Sep 26th 2025 4:00am, by Joab Jackson
Chef Creator Unveils AI Platform To Fix Flaws With Infrastructure
Automation
Aug 27th 2025 8:00am, by Heather Joslyn
Platform Engineering Is Failing -- Here's Why Infrastructure Comes
First
Aug 7th 2025 10:00am, by Lukas Gentele
Unix: OpenSolaris Lives on in This OpenIndiana Fork
Nov 9th 2025 7:00am, by Jack Wallen
Apptainer for Docker Developers: A Comprehensive Guide
Nov 7th 2025 6:00am, by Janakiram MSV
Set Up Talos Linux on Your Machine
Nov 6th 2025 10:10am, by B. Cameron Gain
Open Source Talos Linux: Bringing Simplicity to Kubernetes
Nov 6th 2025 10:00am, by B. Cameron Gain
HydraPWK2 Is a Linux Distribution That Simplifies Pentesting
Nov 2nd 2025 8:00am, by Jack Wallen
How Dapr and WebAssembly Team Up for Microservices
Oct 2nd 2025 6:00am, by B. Cameron Gain
Your CI/CD Pipeline Wasn't Built for Microservices
Aug 7th 2025 7:00am, by Arjun Iyer
Introduction to Microservices
Aug 5th 2025 5:00pm, by TNS Staff
FoundationDB: A Distributed Database That Can't Be Killed
Jul 25th 2025 7:00am, by Joab Jackson
Why Scaling Makes Microservices Testing Exponentially Harder
Jul 16th 2025 11:00am, by Arjun Iyer
FFmpeg to Google: Fund Us or Stop Sending Bugs
Nov 11th 2025 8:30am, by Steven J. Vaughan-Nichols
Reinventing PostgreSQL for the Next Generation of Apps
Nov 6th 2025 12:00pm, by Chris J. Preimesberger
The Reality of Open Source: More Puppies, Less Beer
Nov 6th 2025 11:00am, by Michael Donovan
Microsoft Launches Magentic Marketplace for AI Agents
Nov 5th 2025 9:00am, by Richard MacManus
Fixes Required for Prometheus' OpenTelemetry Integration
Nov 4th 2025 4:00pm, by B. Cameron Gain
Tailscale Welcomes Kubernetes Co-Founder Joe Beda as Advisor
Nov 10th 2025 5:00am, by Joab Jackson
Monitor Docker Containers Across Servers With Beszel
Nov 7th 2025 2:00pm, by Jack Wallen
Build Your First HTTP Server in Python
Nov 4th 2025 3:00pm, by Jessica Wachtel
How To Deploy a Local AI via Docker
Oct 23rd 2025 11:00am, by Jack Wallen
Breaking the 'Shared-Nothing' Bottleneck: A NoSQL Paradigm
Oct 23rd 2025 8:00am, by Carol Platz
Why Inkless Kafka Is a Game-Changer for Running Kafka at Scale
Nov 4th 2025 2:00pm, by Vicki Walker
How Bucket Forking Brings GitHub-Style Forking To Object Storage
Nov 3rd 2025 11:00am, by Jelani Harper
Kelsey Hightower on Engineering at Scale
Nov 3rd 2025 10:00am, by Cynthia Dunlop
2 Fixes Vastly Cut TiKV Write Stalls From SST File Ingestion
Oct 24th 2025 11:00am, by Jinpeng Zhang and Wilco Huang
Breaking the 'Shared-Nothing' Bottleneck: A NoSQL Paradigm
Oct 23rd 2025 8:00am, by Carol Platz
AI AI Engineering API Management Backend development Data Frontend
Development Large Language Models Security Software Development 
WebAssembly
FFmpeg to Google: Fund Us or Stop Sending Bugs
Nov 11th 2025 8:30am, by Steven J. Vaughan-Nichols
The LLM Flywheel Effect: AI That Writes and Tests Documentation
Nov 10th 2025 11:00am, by Jon Udell
Exploring RTEB, a New Benchmark To Evaluate Embedding Models
Nov 10th 2025 10:00am, by Thibaut Gourdel
Why SAP Is Opening Up Its Data and Developer Ecosystems
Nov 10th 2025 9:00am, by Frederic Lardinois
The Search API Reset: Incumbents Retreat, Innovators Step Up
Nov 7th 2025 7:00am, by Tim Young
The Search API Reset: Incumbents Retreat, Innovators Step Up
Nov 7th 2025 7:00am, by Tim Young
Future-Proof Your Strategy With an Open Source AI Playbook
Nov 6th 2025 2:00pm, by Vicki Walker
The Production Generative AI Stack: Architecture and Components
Nov 6th 2025 8:00am, by Janakiram MSV
How AI Can Boost Human Ingenuity in Software Development
Nov 6th 2025 6:00am, by Dario Esposito
LLMs Broke the SRE Runbook. Now What?
Nov 5th 2025 10:00am, by Sylvain Kalache
Conformant Kubernetes Update Availability Varies Significantly Across
Services
Nov 6th 2025 1:00pm, by B. Cameron Gain
MCP vs. API Gateways: They're Not Interchangeable
Oct 20th 2025 8:00am, by Christian Posta
React Native Rolls Out Its Latest Version on New Architecture
Oct 18th 2025 7:00am, by Loraine Lawson
The Modern APIs Roundtable: How AI Creates New Challenges for API
Security
Oct 15th 2025 11:00am, by Adam LaGreca
Kong Releases Volcano, an MCP-Native SDK for Building AI Agents
Oct 15th 2025 10:00am, by Loraine Lawson
Vibe Coding: When AI Writes the Code, Who Secures It?
Sep 26th 2025 1:00pm, by Crystal Morin
How MCP Uses Streamable HTTP for Real-Time AI Tool Interaction
Aug 18th 2025 10:34am, by Janakiram MSV
A Backend for Frontend: Watt for Node.js Simplifies Operations
Aug 14th 2025 6:00am, by Loraine Lawson
Human-on-the-Loop: The New AI Control Model That Actually Works
Aug 4th 2025 8:00am, by Steve Wilson
IT Orchestration Is the Secret Behind Smooth, Scalable IT Operations
Aug 3rd 2025 10:00am, by Prashanth Nanjundappa
Reinventing PostgreSQL for the Next Generation of Apps
Nov 6th 2025 12:00pm, by Chris J. Preimesberger
Deepnote, a 'Successor to Jupyter Notebook,' Goes Open Source
Nov 4th 2025 1:00pm, by Heather Joslyn
How Bucket Forking Brings GitHub-Style Forking To Object Storage
Nov 3rd 2025 11:00am, by Jelani Harper
Apache Arrow's Final Frontier: Replacing Outdated Database Drivers
Nov 3rd 2025 9:00am, by Joab Jackson
Confluent Provides a Real-Time Context Engine for AI
Oct 29th 2025 8:00am, by Joab Jackson
React's UseEffect Is a Crime Scene Covered in Fingerprints
Nov 11th 2025 7:16am, by Alexander T. Williams
How To Build WebAssembly Components With the MoonBit Language
Nov 8th 2025 7:00am, by David Eastman
Frontend or Backend: Where Full-Stack Devs Spend Their Time
Nov 8th 2025 6:00am, by Loraine Lawson
Tactics to End Dark Patterns in App and Web Development
Nov 7th 2025 8:01am, by Loraine Lawson
Why Frontend Developers Should Ditch Dark Patterns
Nov 6th 2025 7:00am, by Loraine Lawson
Exploring RTEB, a New Benchmark To Evaluate Embedding Models
Nov 10th 2025 10:00am, by Thibaut Gourdel
Context Engineering: The Foundation for Reliable AI Agents
Oct 31st 2025 1:00pm, by Kiran Matty
KAITO and KubeFleet: Projects Solving AI Inference at Scale
Oct 31st 2025 10:00am, by Sachi Desai and Simon Waight
Beyond 'Shift Left': Improving AI Training Data
Oct 28th 2025 6:00am, by Manish Kapur
Eliminating the Precision-Latency Trade-Off in Large-Scale RAG
Oct 3rd 2025 9:00am, by Bonnie Chase
FFmpeg to Google: Fund Us or Stop Sending Bugs
Nov 11th 2025 8:30am, by Steven J. Vaughan-Nichols
HydraPWK2 Is a Linux Distribution That Simplifies Pentesting
Nov 2nd 2025 8:00am, by Jack Wallen
What Good Software Supply Chain Security Looks Like 
Oct 29th 2025 11:00am, by Rita Manachi and William Jimenez
Shadow AI: The Growing Risk IT Leaders Must Address
Oct 29th 2025 7:30am, by Steve Croce
Beyond 'Shift Left': Improving AI Training Data
Oct 28th 2025 6:00am, by Manish Kapur
The LLM Flywheel Effect: AI That Writes and Tests Documentation
Nov 10th 2025 11:00am, by Jon Udell
How To Build WebAssembly Components With the MoonBit Language
Nov 8th 2025 7:00am, by David Eastman
Frontend or Backend: Where Full-Stack Devs Spend Their Time
Nov 8th 2025 6:00am, by Loraine Lawson
Monitor Docker Containers Across Servers With Beszel
Nov 7th 2025 2:00pm, by Jack Wallen
Tactics to End Dark Patterns in App and Web Development
Nov 7th 2025 8:01am, by Loraine Lawson
How To Build WebAssembly Components With the MoonBit Language
Nov 8th 2025 7:00am, by David Eastman
Wasm 3.0: No Component Model and No 'Docker Moment'
Oct 6th 2025 3:00pm, by B. Cameron Gain
How Dapr and WebAssembly Team Up for Microservices
Oct 2nd 2025 6:00am, by B. Cameron Gain
Wasm 3.0 Offers New Way to Handle JavaScript Strings
Sep 20th 2025 7:14am, by Loraine Lawson
Flutter 3.5 Offers New Developer Experience Features
Aug 30th 2025 6:00am, by Loraine Lawson
AI Operations CI/CD Cloud Services DevOps Kubernetes Observability 
Operations Platform Engineering
Future-Proof Your Strategy With an Open Source AI Playbook
Nov 6th 2025 2:00pm, by Vicki Walker
LLMs Broke the SRE Runbook. Now What?
Nov 5th 2025 10:00am, by Sylvain Kalache
Kelsey Hightower on Engineering at Scale
Nov 3rd 2025 10:00am, by Cynthia Dunlop
What Is an AI PaaS? A Guide to the Future of AI Development
Oct 30th 2025 12:40pm, by Doug Sillars
Shadow AI: The Growing Risk IT Leaders Must Address
Oct 29th 2025 7:30am, by Steve Croce
KubeCon: Akuity Reduces Kubernetes Guesswork With AI
Nov 11th 2025 5:15am, by Joab Jackson
Build Terraform Modules That Your Team Will Actually Reuse
Nov 7th 2025 10:00am, by Rak Siva
OpenTelemetry Experts on Tough Telemetry Challenges in Mobile
Nov 7th 2025 9:00am, by Colin Contreary
The Search API Reset: Incumbents Retreat, Innovators Step Up
Nov 7th 2025 7:00am, by Tim Young
The Reality of Open Source: More Puppies, Less Beer
Nov 6th 2025 11:00am, by Michael Donovan
Google Debuts GKE Agent Sandbox, Inference Gateway at KubeCon
Nov 11th 2025 4:00am, by Joab Jackson
LLMs Broke the SRE Runbook. Now What?
Nov 5th 2025 10:00am, by Sylvain Kalache
The Promise of Redundancy: Can the Impact of a Cloud Outage Be
Avoided? 
Oct 31st 2025 12:10pm, by Joe Vaccaro
The Great AWS Outage: The $11 Billion Argument for Kubernetes
Oct 28th 2025 9:00am, by Arjun Iyer
AWS Adds Scope 3 Emissions Data to Customer Carbon Footprint Tool
Oct 25th 2025 12:00pm, by Charles Humble
Go Beyond DevOps With Autonomous Full-Stack Optimization
Nov 10th 2025 7:00am, by Charles Humble
Survey: Where AI Reduces Toil and Where It Still Falls Short
Nov 6th 2025 9:00am, by Fahmid Kabir
LLMs Broke the SRE Runbook. Now What?
Nov 5th 2025 10:00am, by Sylvain Kalache
Pulumi's AI Agent Tackles Infrastructure Compliance Backlogs
Nov 5th 2025 6:00am, by Darryl K. Taft
Addressing 3 Failure Points of Multiregion Incident Response
Oct 30th 2025 5:00am, by Cristina Dias
Google Debuts GKE Agent Sandbox, Inference Gateway at KubeCon
Nov 11th 2025 4:00am, by Joab Jackson
Kubecon: VCluster's K8s Platform to Manage GPUs as a Service
Nov 10th 2025 8:00am, by Joab Jackson
Go Beyond DevOps With Autonomous Full-Stack Optimization
Nov 10th 2025 7:00am, by Charles Humble
Practitioners' Guide to Chiseled Containers: Smaller, Faster, Safer
Nov 10th 2025 6:00am, by Pankaj Gupta
Tailscale Welcomes Kubernetes Co-Founder Joe Beda as Advisor
Nov 10th 2025 5:00am, by Joab Jackson
An Observability Veteran on AI's 'Intoxicating' Potential
Nov 8th 2025 8:00am, by Michele Mancioppi
OpenTelemetry Experts on Tough Telemetry Challenges in Mobile
Nov 7th 2025 9:00am, by Colin Contreary
Struggling With OpenTelemetry Setup? Injector Makes It Easier
Nov 5th 2025 11:00am, by Morgan McLean
Fixes Required for Prometheus' OpenTelemetry Integration
Nov 4th 2025 4:00pm, by B. Cameron Gain
Why Your Observability Strategy Should Start With SLOs
Nov 3rd 2025 8:15am, by B. Cameron Gain
KubeCon: Akuity Reduces Kubernetes Guesswork With AI
Nov 11th 2025 5:15am, by Joab Jackson
Process Theater vs. Technical Excellence: A Recurring Software Crisis
Nov 10th 2025 1:00pm, by Steve Fenton
How Distributed Databases Power Developer Platforms at Scale
Nov 10th 2025 12:00pm, by Gaurav Saxena
Unix: OpenSolaris Lives on in This OpenIndiana Fork
Nov 9th 2025 7:00am, by Jack Wallen
An Observability Veteran on AI's 'Intoxicating' Potential
Nov 8th 2025 8:00am, by Michele Mancioppi
How Distributed Databases Power Developer Platforms at Scale
Nov 10th 2025 12:00pm, by Gaurav Saxena
Conformant Kubernetes Update Availability Varies Significantly Across
Services
Nov 6th 2025 1:00pm, by B. Cameron Gain
Kubernetes and AI Are Shaping the Next Generation of Platforms
Nov 2nd 2025 9:00am, by Ana Margarita Medina and Viktor Farcic
How Cover Whale Scaled Its Developer Platform Beyond an MVP
Oct 31st 2025 5:00am, by Laurent Sibilla
What Is an AI PaaS? A Guide to the Future of AI Development
Oct 30th 2025 12:40pm, by Doug Sillars
C++ Developer tools Go Java JavaScript Programming Languages Python 
Rust TypeScript
Rust vs. C++: a Modern Take on Performance and Safety
Oct 22nd 2025 2:00pm, by Zziwa Raymond Ian
Building a Real-Time System Monitor in Rust Terminal
Oct 15th 2025 7:05am, by Tinega Onchari
SQL vs. Python: Frenemies of the Data World
Oct 14th 2025 7:00am, by Ivan Novick
The 'Obfuscated C Code Contest' Confronts the Age of AI
Aug 17th 2025 6:00am, by David Cassel
How AI Can Help You Learn the Art of Programming
Jun 20th 2025 9:00am, by Jack Wallen
Why SAP Is Opening Up Its Data and Developer Ecosystems
Nov 10th 2025 9:00am, by Frederic Lardinois
SAP Expands Its AI Stack for Developers
Nov 5th 2025 12:00pm, by Frederic Lardinois
New Open Source Tool from Angular Scores Vibe Code Quality
Oct 29th 2025 9:00am, by Loraine Lawson
GitHub Embraces the Coding Agent Competition With Agent HQ
Oct 28th 2025 9:10am, by Frederic Lardinois
Vercel Marketplace Offers Agentic AI Building Blocks
Oct 25th 2025 10:00am, by Loraine Lawson
Go Experts: 'I Don't Want to Maintain AI-Generated Code'
Sep 28th 2025 6:00am, by David Cassel
How To Run Kubernetes Commands in Go: Steps and Best Practices 
Jun 27th 2025 8:00am, by Sunny Yadav
Prepare Your Mac for Go Development
Apr 12th 2025 7:00am, by Damon M. Garn
Pagoda: A Web Development Starter Kit for Go Programmers
Mar 19th 2025 6:10am, by Loraine Lawson
Microsoft TypeScript Devs Explain Why They Chose Go Over Rust, C#
Mar 18th 2025 7:00am, by David Cassel
Why Bloomberg Chose Vendor-Neutral Java Over Big Tech
Oct 2nd 2025 5:00pm, by Darryl K. Taft
Microsoft AI Agents Automate Enterprise Java and .NET Migrations
Sep 26th 2025 4:00pm, by Darryl K. Taft
Java 25: Oracle Makes Java Easier To Learn, Ready for AI Development
Sep 18th 2025 4:00pm, by Darryl K. Taft
Vibe Coding Fails Enterprise Reality Check
Sep 10th 2025 4:00pm, by Darryl K. Taft
New Tool Ends Java Configuration Nightmare in K8s
Aug 21st 2025 3:00pm, by Darryl K. Taft
React's UseEffect Is a Crime Scene Covered in Fingerprints
Nov 11th 2025 7:16am, by Alexander T. Williams
Frontend or Backend: Where Full-Stack Devs Spend Their Time
Nov 8th 2025 6:00am, by Loraine Lawson
Why React's 'Boring' Maturity Is Actually Its Main Strength
Nov 4th 2025 9:00am, by Alexander T. Williams
JavaScript Utility Library Lodash Changing Governance Model
Nov 1st 2025 7:00am, by Loraine Lawson
How Next.js Got Its Snappy Client Navs Back
Oct 31st 2025 8:00am, by Loraine Lawson
Build Your First HTTP Server in Python
Nov 4th 2025 3:00pm, by Jessica Wachtel
OpenTelemetry Adoption Update: Rust, Prometheus and Other Speed Bumps
Oct 26th 2025 11:00am, by B. Cameron Gain
Rust vs. C++: a Modern Take on Performance and Safety
Oct 22nd 2025 2:00pm, by Zziwa Raymond Ian
React Foundation Leader on What's Next for the Framework
Oct 21st 2025 11:05am, by Loraine Lawson
SQL vs. Python: Frenemies of the Data World
Oct 14th 2025 7:00am, by Ivan Novick
PSF Gets a Donor Surge After Rejecting Anti-DEI Federal Grant
Nov 9th 2025 6:00am, by David Cassel
Build Your First HTTP Server in Python
Nov 4th 2025 3:00pm, by Jessica Wachtel
The Rise of JavaScript in Machine Learning
Oct 23rd 2025 9:03am, by Loraine Lawson
SQL vs. Python: Frenemies of the Data World
Oct 14th 2025 7:00am, by Ivan Novick
A Cloud Built for Python Data Scientists, Not Infrastructure
Engineers
Oct 5th 2025 6:00am, by David Cassel
Moving From C++ to Rust? Clickhouse Has Some Advice
Nov 5th 2025 7:00am, by Joab Jackson
Why Sudo-rs Brings Modern Memory Safety to Ubuntu 26.04
Oct 28th 2025 7:30am, by Steven J. Vaughan-Nichols
OpenTelemetry Adoption Update: Rust, Prometheus and Other Speed Bumps
Oct 26th 2025 11:00am, by B. Cameron Gain
How TARmageddon Compromises Rust Security: A Developer's Guide
Oct 24th 2025 10:00am, by Steven J. Vaughan-Nichols
Rust vs. C++: a Modern Take on Performance and Safety
Oct 22nd 2025 2:00pm, by Zziwa Raymond Ian
JavaScript Utility Library Lodash Changing Governance Model
Nov 1st 2025 7:00am, by Loraine Lawson
Microsoft TypeScript Devs Explain Why They Chose Go Over Rust, C#
Mar 18th 2025 7:00am, by David Cassel
Go Power: Microsoft's Bold Bet on Faster TypeScript Tools
Mar 12th 2025 1:00pm, by Darryl K. Taft and Loraine Lawson
Oracle Won't Release 'JavaScript' Without a Fight
Jan 11th 2025 5:00am, by Loraine Lawson
The Year in JavaScript: Top JS News Stories of 2024
Dec 27th 2024 6:30am, by Loraine Lawson
2025-11-11 08:30:08
FFmpeg to Google: Fund Us or Stop Sending Bugs
AI / Open Source / Security

FFmpeg to Google: Fund Us or Stop Sending Bugs

A lively discussion about open source, security, and who pays the
bills has erupted on Twitter. 
Nov 11th, 2025 8:30am by Steven J. Vaughan-Nichols
Featued image for: FFmpeg to Google: Fund Us or Stop Sending Bugs
Image from Unsplash.

You may never have heard of FFmpeg, but you've used it. This open
source program's robust multimedia framework is used to process video
and audio media files and streams across numerous platforms and
devices. It provides tools and libraries for format conversion, aka
transcoding, playback, editing, streaming, and post-production
effects for both audio and video media.

FFmpeg's libraries, such as libavcodec and libavformat, are essential
for media players and software, including VLC, Kodi, Plex, Google
Chrome, Firefox, and even YouTube's video processing backend. It is
also, like many other vital open source programs, terribly
underfunded.

Corporate Responsibility vs. Volunteer Labor

A lively debate on Twitter began between Dan Lorenc, CEO and
co-founder of Chainguard, the software supply chain security company,
the FFmpeg project, Google, and security researchers over security
disclosures and the responsibilities of large tech companies in
open-source software.

The core of the discussion revolves around how vulnerabilities should
be reported, who is responsible for fixing them, and the challenges
that arise when AI is used to uncover a flood of potentially
meaningless security issues. But at heart, it's about money.

An Obscure Bug Ignites the Controversy

This discussion has been heating up for some time. In mid-October,
FFmpeg tweeted that "security issues are taken extremely seriously in
FFmpeg, but fixes are written by volunteers." This point cannot be
emphasised enough. As FFmpeg tweeted later, "FFmpeg is written almost
exclusively by volunteers."

Thus, as Mark Atwood, an open source policy expert, pointed out on
Twitter, he had to keep telling Amazon to not do things that would
mess up FFmpeg because, he had to keep explaining to his bosses that
"They are not a vendor, there is no NDA, we have no leverage, your VP
has refused to help fund them, and they could kill three major
product lines tomorrow with an email. So, stop, and listen to me ... "

The Growing Burden on Open Source Maintainers

The latest episode was sparked after a Google AI agent found an
especially obscure bug in FFmpeg. How obscure? This "medium impact
issue in ffmpeg," which the FFmpeg developers did patch, is "an issue
with decoding LucasArts Smush codec, specifically the first 10-20
frames of Rebel Assault 2, a game from 1995."

Wow.

FFmpeg added, "FFmpeg aims to play every video file ever made."
That's all well and good, but is that a valuable use of an assembly
programmer's time? Oh, right, you may not know. FFmpeg's heart is
assembly language. As a former assembly language programmer, it is
not, in any way, shape, or form, easy to work with.

As FFmpeg put it, this is "CVE slop."

Many in the FFmpeg community argue, with reason, that it is
unreasonable for a trillion-dollar corporation like Google, which
heavily relies on FFmpeg in its products, to shift the workload of
fixing vulnerabilities to unpaid volunteers. They believe Google
should either provide patches with vulnerability reports or directly
support the project's maintenance.

Earlier, FFmpeg pointed out that it's far from the only open source
project to face such issues.

Specifically, the project team mentions Nick Wellnhofer, the former
maintainer of libxml2, a widely used open source software library for
parsing Extensible Markup Language (XML). Wellnhofer recently
resigned from maintaining libxml2 because he had to "spend several
hours each week dealing with security issues reported by third
parties. Most of these issues aren't critical, but it's still a lot
of work.

"In the long term, this is unsustainable for an unpaid volunteer like
me. ... In the long run, putting such demands on OSS maintainers
without compensating them is detrimental. ...  It's even more unlikely
with Google Project Zero, the best white-hat security researchers
money can buy, breathing down the necks of volunteers."

Google's Controversial Security Disclosure Policy

What made this a hot issue was that back in July, Google Project Zero
(GPZ) announced a trial of its new Reporting Transparency policy.
With this policy change, GPZ announces that it has reported an issue
on a specific project within a week of discovery, and the security
standard 90-day disclosure clock then starts, regardless of whether a
patch is available or not.

Many volunteer open source program maintainers and developers feel
this is massively unfair to put them under such pressure when Google
has billions to address the problem.

FFmpeg tweeted, "We take security very seriously, but at the same
time, is it really fair that trillion-dollar corporations run AI to
find security issues in people's hobby code? Then expect volunteers
to fix."

True, Google does offer a Patch Rewards Program, but as a Twitter
user using the handle Ignix The Salamander observed, "FFmpeg already
mentioned the program is too limited for them, and they point out the
three patches per month limit. Please don't assume people complain
just for the sake of complaining, there is a genuine conflict between
corporate security & usage vs open source support IMHO."

Lorenc argues back, in an e-mail to me, that "Creating and publishing
software under an open source license is an act of contribution to
the digital commons. Finding and publishing information about
security issues in that software is also an act of contribution to
the same commons.

"The position of the FFmpeg X account is that somehow disclosing
vulnerabilities is a bad thing. Google provides more assistance to
open source software projects than almost any other organization, and
these debates are more likely to drive away potential sponsors than
to attract them."

Differing Perspectives on Vulnerability Disclosures

The fundamental problem remains that the FFmpeg team lacks the
financial and developer resources to address a flood of AI-created
CVEs.

On the other hand, security experts are certainly right in thinking
that FFmpeg is a critical part of the Internet's technology framework
and that security issues do need to be made public responsibly and
addressed. After all, hackers can use AI to find vulnerabilities in
the same way Google does with its AI bug finder, Big Sleep, and
Google wants to identify potential security holes ahead of them.

The reality is, however, that without more support from the
trillion-dollar companies that profit from open source, many woefully
underfunded, volunteer-driven critical open-source projects will no
longer be maintained at all.

For example, Wellnhofer has said he will no longer maintain libxml2
in December. Libxml2 is a critical library in all web browsers, web
servers, LibreOffice and numerous Linux packages. We don't need any
more arguments; we need real support for critical open source
programs before we have another major security breach.

TRENDING STORIES
 
YOUTUBE.COM/THENEWSTACK
Tech moves fast, don't miss an episode. Subscribe to our YouTube
channel to stream all our podcasts, interviews, demos, and more.
SUBSCRIBE
Created with Sketch.
 
[cee63948-c]
Steven J. Vaughan-Nichols, aka sjvn, has been writing about
technology and the business of technology since CP/M-80 was the
cutting-edge PC operating system, 300bps was a fast internet
connection, WordStar was the state-of-the-art word processor, and we
liked it.
Read more from Steven J. Vaughan-Nichols
SHARE THIS STORY
     
TRENDING STORIES
Amazon Web Services and Chainguard are sponsors of The New Stack,
SHARE THIS STORY
     
TRENDING STORIES
TNS DAILY NEWSLETTER Receive a free roundup of the most recent TNS
articles in your inbox each day.
[                    ] SUBSCRIBE
The New Stack does not sell your information or share it with
unaffiliated third parties. By continuing, you agree to our Terms of
Use and Privacy Policy.
ARCHITECTURE
Cloud Native Ecosystem Containers Databases Edge Computing 
Infrastructure as Code Linux Microservices Open Source Networking 
Storage
ENGINEERING
AI AI Engineering API Management Backend development Data Frontend
Development Large Language Models Security Software Development 
WebAssembly
OPERATIONS
AI Operations CI/CD Cloud Services DevOps Kubernetes Observability 
Operations Platform Engineering
CHANNELS
Podcasts Ebooks Events Webinars Newsletter TNS RSS Feeds
THE NEW STACK
About / Contact Sponsors Advertise With Us Contributions
 
roadmap.sh

Community created roadmaps, articles, resources and journeys for
developers to help you choose your path and grow in your career.

Frontend Developer Roadmap Backend Developer Roadmap Devops Roadmap
(c) The New Stack 2025
Disclosures Terms of Use Advertising Terms & Conditions Privacy
Policy Cookie Policy
FOLLOW TNS
        
* *