EU to fund bug bounty programs for open-source projects

Re:EU to fund bug bounty programs for open-source projects by a_bonobo on Sunday December 30, 2018 @06:24AM (#18788609)

Of these, I'm pretty sure VLC is the most common software on end-user systems - and there are enough security advisories where a well-crafted video file can execute code with user privileges (like https://www.videolan.org/security/sa1801.html ), if you can automate that you have access to many personal computers in the EU

[ Parent | on HN ]

Re:EU to fund bug bounty programs for open-source projects by amenod on Sunday December 30, 2018 @09:04AM (#18789212)

Also, VLC has a huge attack surface - binary parsing is difficult to do right in C / C++. I hope this effort makes the crashes less frequent...

[ Parent | on HN ]

Re:EU to fund bug bounty programs for open-source projects by cyphar on Sunday December 30, 2018 @10:07AM (#18789464)

There's work going on (since 2016) to port the parsers to Rust[1]. I believe that a few already are written in Rust, and it'd be great if some Rust folks would help out with the effort.

[1]: https://youtu.be/YTy_JOxGOd4

[ Parent | on HN ]

Re:EU to fund bug bounty programs for open-source projects by justaj on Sunday December 30, 2018 @09:29AM (#18789312)

Is mpv [0] better in this regard?

0: https://mpv.io/

[ Parent | on HN ]

Re:EU to fund bug bounty programs for open-source projects by kilotaras on Sunday December 30, 2018 @11:38AM (#18789921)

GP isn't saying that VLC is unsafe, but rather that C (which VLC is written in) tends to be unsafe. Seeing as MPV is also written in C, it's absolutely the same in that regard.

[ Parent | on HN ]

Re:EU to fund bug bounty programs for open-source projects by Nullabillity on Monday December 31, 2018 @08:34AM (#18794408)

AFAIK both VLC and mpv use FFmpeg's codecs, so their attack surfaces should be similar.

[ Parent | on HN ]