Very long HN thread that I haven’t had the stomach to look at: https://news.ycombinator.com/item?id=45891016

I don’t understand how a bug is supposed to know whether it’s triggered inside or outside of a google service. If the bug can only be triggered in some weird, google-specific deployment, that’s one thing, but I don’t think that’s what we’re talking about here. If the bug is manifestly present in ffmpeg and it’s discovered at google, what are you saying is supposed to happen? Google should a) report it under the normal 90 day disclosure rule; b) report it but let it stay undisclosed for longer than normal, due to the resource contraints ffmpeg’s devs areunder; c) not report it and let some attacker exploit it? (b) might have some merit but (c) is insane. Once some bad actor finds out about the bug (through independent discovery or any other way), it’s going to be exploited. That might already be happening before even google finds the bug.

FFmpeg’s codebase and dev community are both exceptionally difficult and that is not helping matters, I’m sure.

There are a bunch of Rust zealots busily rewriting GNU Coreutils which in practice have been quite reliable and not that badly in need of rewriting. Maybe the zealots should turn their attention to ffmpeg (a bug minefield of long renown) instead.

Alternatively (or in addition), some effort should go into sandboxing ffmpeg so its bugs can be contained.

AI reports are ignored because they are so frequently crap that they are almost not worth investigating. If these ffmpeg reports are from Project Zero though, they are presumably real. Shipping code with vulnerabilities is always a terrible idea. If Google can find them, attackers can also find them.

I do have to wonder how many of these vulnerabilities are actually in the assembly language parts of the codecs. I had guessed they were more likely to be at the higher levels.

Google having found the bugs can either submit bug reports or quietly sit on them, or even exploit them as spyware, among other ideas. Whether they fund ffmpeg is a completely separate question. I can see how the 90 day disclosure window can be a problem if the number of reports is high.

If there’s a vulnerability in the codec, then someone can slip a malicious file onto some web site and use it as an exploit. It’s not only about some 30 year old game. It might be appropriate for ffmpeg to get rid of such obscure codecs, or sandbox them somehow so RCE’s can’t escape from them, even at an efficiency cost. Yes though, Google funding or even a Summer of Code sponsorship would be great.

I’d like FFmpeg to get more funding, but the bugs being reported are valid security bugs, so it seems desirable to send them anyway, preferably with fixes.

Get a cheap one on lowendspirit.com instead.

Depends on the specs. If it’s really old the power consumption will cost more than you’d spend on newer hardware. I have such a box sitting at home doing nothing. It’s cheaper to rent a hetzner dedi.

Just get a vps it still counts as self hosting if you run all the software yourself.

That leaves you with 17 more of them though.

These are mini PCs right? So you want something with a room full of humans or some type of local online service. Anyway, not a purely computer project.

Library terminals and game room come to mind, but neither are for installing at home.

I use remote encrypted backup and it’s been good so far. Hetzner Storage box, around $11/month for 5TB, pretty reasonable. If you want a lot more storage you can pay somewhat less per TB.

I don’t see much need to retain or upload dashcam video unless something happens. It’s so you can document what happened if you’re in a crash, get a ticket, or whatever. Otherwise just re-use the storage. You don’t need to permanently record every moment of your life.

Some people use TPM hardware for this. Others (big cloud operators) have a ton of complicated infrastructure involving among other things special key servers on a walled off LAN. I don’t know a really satisfying answer, so will keep watching the thread.

https://duckduckgo.com/?q=thermal+paper+toxic gets some hits.

"Dear q1p_: I am Prince Sani Abacha of Nigeria and… "

Cute. I wanted to make something like that for my mom (so friends and family could message her on it, not for strangers) but I never got around to it. She knew how to use email but didn’t check it very often, so a printer would have been more immediate. It would have to have been an impact printer though, since another family member (probably correctly) wanted to stay away from thermal paper on health grounds.

Maybe this is what you saw:

https://aschmelyun.com/blog/i-invited-strangers-to-message-me-through-a-receipt-printer/

Someone mentioned Immich recently and it sounded like the cool kids are using it now, so maybe it’s worth looking into. I’m just a cavedweller and use command line mplayer, but given all the song metadata, the features you mention are pretty easy to do. Is every song necessarily on an album though?

libvirt comes with some gui tool of its own, though I haven’t used it. I generally prefer to understand what I’m doing, so I use command line tools or API’s at first. GUI’s are a convenience to use later, once it’s clear how they work.

Proxmox is a convenient gui wrapper around libvirt but you can do everything without it.

https://wiki.debian.org/libvirt