Post B7haamDq1K99BUqpEm by wyatt@soc.megatokyo.moe
 (DIR) More posts by wyatt@soc.megatokyo.moe
 (DIR) Post #B7gw1jKKnRgPu3chw8 by cwebber@social.coop
       1 likes, 2 repeats
       
       A vulnerability in ffmpeg allows remote code execution via a crafted media file https://www.securityweek.com/ffmpeg-pixelsmash-flaw-allows-rce-on-video-players-media-servers-nas-appliances/This affects anything that would even try to generate a *thumbnail*, and that includes your file browser, your fedi server, etc etc etc.
       
 (DIR) Post #B7gw1jY9y2k4aw5kUC by cwebber@social.coop
       0 likes, 0 repeats
       
       Doesn't look like Guix has a patch yet.Uh, try to run... everything in containers right now I guess?
       
 (DIR) Post #B7gw1jinKVFV7v4F3w by cwebber@social.coop
       1 likes, 0 repeats
       
       Someone was dropping mysterious links in libera.chat to media files. I wonder if that's what they were doing.
       
 (DIR) Post #B7gw1kCDZ6mibApjvM by cwebber@social.coop
       0 likes, 0 repeats
       
       Christ, I wish I was running an ocap-secure OS. Things are getting so scary.
       
 (DIR) Post #B7hAz64PHReaspNMC8 by natty@astolfo.social
       0 likes, 0 repeats
       
       @cwebber@social.coop a huge API surface has a vulnerability, more at 11I'm impressed something as huge as ffmpeg isn't horribly broken. Probably only because companies spend millions on hardening itSeriously though, I think Glycin is a very good idea
       
 (DIR) Post #B7haagdqlhO9sQyVwu by lottie@social.vlhl.dev
       0 likes, 0 repeats
       
       @kimapr oh yea i just saw. lowk sensationalist
       
 (DIR) Post #B7haagpC5WSkRcHZdA by lottie@social.vlhl.dev
       0 likes, 0 repeats
       
       @kimapr btw this is really bad bcs shit like proton is basically stuck on ancient ffmpeg version. changing it isn't very feasible because it would likely break a bunch of games (it's hard to estimate the impact, but basically bumping anything in the stack always explodes a bunch of things), probably will have to backport a patch
       
 (DIR) Post #B7haah0XPLXL0nadJQ by wyatt@soc.megatokyo.moe
       0 likes, 0 repeats
       
       @lottie @kimapr guessing this is partially due to ffmpeg breaking its ABI every 10 minutes :p
       
 (DIR) Post #B7haahGqQia3pNDejI by lottie@social.vlhl.dev
       0 likes, 1 repeats
       
       @wyatt @kimapr ABI of libraries is not an issue for proton at all since we target a predictable and fixed environment (steamrt) and we can just recompile proton if we need to move to a new version of a library. the unstable API presents a minor issue, but not really the core of the problem. upstream wine works with a broad range of ffmpeg versions and its usage of ffmpeg interfaces is pretty basic, so it's unlikely to be broken by any change. proton uses some non-public interfaces for filtering. but I managed to perform a major version bump of ffmpeg in a day or so. the bigger problem is just how cursed our domain is; proprietary games contain some of the most heinous nonsense imaginable; things like internal buffer sizes changing, timing, tolerance towards files that deviate from the file format spec etc. can all screw things over in unexpected ways, even tho none of these things should ever be part of the contract between a library and a consumer. in many ways this issue is just unique to the type of thing we do and not a failure of whatever libraries we use. even windows routinely breaks proprietary games through no fault of their own; shit like refactoring some I/O function internally which changes its stack usage pattern, which then caused some code in GTA san andreas that relied on the contents of *uninitialized memory* to malfunction, and some vehicles being no longer spawnable.essentially, any major change to our code means we have to retest many games to see the impact, no matter how internal it is supposed to be.in wine and proton, a lot of the heavy lifting right now is still done by gstreamer, the parts that we use ffmpeg for are new and optional right now, but enabled by default in proton. the problem is that even tho gstreamer has a stable ABI its architecture works against us at every step of the way, it turns features that take 5 minutes to do with ffmpeg into features that take a week with gstreamer, not because you have to write a lot of code, but because you have to painfully convince it to actually do what you want. basically everyone who has had to touch media code wants to move to ffmpeg long term, except one person who insists the stable abi matters more.
       
 (DIR) Post #B7haahWnTPLCcqgOau by wyatt@soc.megatokyo.moe
       0 likes, 1 repeats
       
       @lottie @kimapr "the problem is that even tho gstreamer has a stable ABI its architecture works against us at every step of the way"This PERFECTLY aligns with my attempts to port a gstreamer 0.10 codebase to 1.0 versus updating ffmpeg API calls in the same program.
       
 (DIR) Post #B7haamDq1K99BUqpEm by wyatt@soc.megatokyo.moe
       0 likes, 0 repeats
       
       @lottie @kimapr (the program in my case is Gnash, which i have a shitty fork of that I keep limping along)
       
 (DIR) Post #B7haeQmjfILXrAut0a by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @gotosocial have you updated ffmpreg accordingly or should I switch to the nowasm build when upgrading anyway?
       
 (DIR) Post #B7hahwu2hxiuKy0nfE by ju@social.coop
       0 likes, 0 repeats
       
       @cwebber I’m gonna avoid using browsers as much as I can and run everything in a terminal until I get a patch. Bye!
       
 (DIR) Post #B7hahx9zkeU38RTXWq by opensourceopenmind@vivaldi.net
       0 likes, 0 repeats
       
       @ju @cwebber https://chaos.social/@scy/116810785629354955
       
 (DIR) Post #B7hahxX2MyuoHuFwRc by ltning@pleroma.anduin.net
       0 likes, 0 repeats
       
       @opensourceopenmind This is the case with several high-visibility RCE bugs of late. There's a vague blurb about requiring ASLR to be disabled "or bypassed" - but not knowing what bypassing ASLR entails or the likelihood of that happening, it's really hard to assess whether I should be dropping everything or if I can wait until the grey matter is actually awake. The bugs are bad enough. I hate the sensationalism on top. @ju @cwebber
       
 (DIR) Post #B7hahxxcm8BNcMhAsy by moses_izumi@fe.disroot.org
       0 likes, 0 repeats
       
       @ltning @ju @cwebber @opensourceopenmind I hate how half of cybersecurity reports end with "our product can stop this :)"(looking at you, Cisco Talos)It's like if a company wrote a product recall article and the last paragraph was just an ad for the CEO's friend's life insurance company.
       
 (DIR) Post #B7hahyA2206iEqV5E0 by rl_dane@polymaths.social
       0 likes, 1 repeats
       
       @moses_izumi @ltning @ju @cwebber @opensourceopenmindSecurity isn't, never was, and never will be a product.I'm glad I don't know what the #infosec industry is like these days.Even the new name makes me break out in hives: "cyber security"It reeks of Dunning-Kruger and hollywoodified idiocy.
       
 (DIR) Post #B7ham9qWWkzRddNAum by tisba@ruby.social
       0 likes, 1 repeats
       
       @cwebber with all the recent kernel LPEs, containers won’t help much. So maybe… run everything in microVMs now? 🫣
       
 (DIR) Post #B7hatPLvGztVl2W5h2 by aanee@mastodon.online
       0 likes, 0 repeats
       
       @cwebber Oh look, the vulnerability I've been afraid would exist with every meme I've downloaded off Mastodon. 😬
       
 (DIR) Post #B7hatPa6QHEkT19PnM by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @cwebber @aanee "custom emoji"