Comment Re:90 days, huh? (Score 2, Interesting) 79
It used to be 30 days. Apple and Microsoft complained because it didn't give enough time to analyze the problem, fix it, test it, and then do a proper rollout to ensure there weren't unexpected side effects in 30 days.
I think what happened was a kernel flaw, meaning a fix could severely impact other subsystems in the OS and thus a fix would need to be carefully done and a properly staged rollout.
The problem isn't the AI tools - Project Zero has real researchers doing real analysis and making sure those AI issues are real. It's likely they're filing issues FFMPEG feels aren't really issues at all.
You might think a bug in a codec used in a 1996 console isn't relevant for security, but if someone can code up an exploit using it, it's suddenly a big deal. I don't have to play back 1996 console video game to hit the bug, I just need to trick someone into getting FFMPEG to see the file as that format and exploit the security hole. (Think sites like YouTube and such that ingest video, for example)
The problem is, there is no right solution. Is it a real security issue? I don't care if it's only for a platform that only only one game released and no one's ever going to practically use it. If it's a way to break into the software and escape my software stack, it's a security issue because all you need is to have someone pretend to be that file. If not, then let the issue be published - even if you don't want to fix it, people who use it might simply be able to disable ingesting that format at all and eliminate the security hole by not having the feature available.