|
|
Subscribe / Log in / New account

Reconsidering ffmpeg in Debian

By Jonathan Corbet
August 5, 2014
For better or for worse, forks are a part of the free software landscape. Often a fork will result in a reinvigorated development community and the removal of unneeded roadblocks. But not all forks work out well. What is a distributor to do if, at some point, it concludes that it chose wrongly when it followed a fork of an important project? Going back to the original may not always be an easy thing to do, even if there appears to be a consensus for that move. The presence of security concerns can make such a change even harder to contemplate. The recent discussion on welcoming ffmpeg back into Debian illustrates the potential hazards nicely.

FFmpeg is a set of libraries for the handling of files (and streams) containing audio and video data. With its extensive format support, it has long been the definitive library for application developers wanting to work with multimedia streams. It has also, at times, had a history of discord within its development community. Back in early 2011, strong disagreements within this project led to a hostile fork which, eventually, picked up the name libav. Initially the two projects worked with nearly identical code, but they have drifted apart over time.

The Debian distribution chose early on to drop ffmpeg and go with libav. This decision was made in typical Debian style; the Debian developer who maintained ffmpeg was part of the group that created the fork, so he naturally pulled the distribution along for the ride. For the most part, Debian users have not really noticed the change; things generally just work, though, recently, the mplayer video player application has run into trouble due to its being primarily written and tested for ffmpeg rather than libav. Other programs, too, occasionally show signs of their developers paying more attention to working with ffmpeg.

Recently, Andreas Cadhalpun proposed a plan to bring the ffmpeg system back into the Debian distribution. He had a number of reasons for wanting to have ffmpeg in the repository, including compatibility problems between libav and programs like mplayer and the XBMC media center system. There are, he said, a number of features in ffmpeg that have not found their way into libav; these include the "deshake" image stabilization filter and a number of codecs. He also mentioned ffmpeg's active developer community, implying by omission that libav's community is less so. The plan for bringing back ffmpeg has been carefully designed to avoid breaking programs that currently depend on libav. FFmpeg would be carefully installed so that it could live alongside libav and applications could be built against either.

The discussion that ensued made it clear that a number of Debian developers would like to see ffmpeg as part of the distribution again. Indeed, defenders of libav were mostly conspicuous in their absence. It would seem that, in the three years and some since the fork, libav has lost a lot of its charm, at least in the Debian community. Given Debian's tendency toward including almost anything if a developer wants to maintain it, one would think that putting ffmpeg back would be uncontroversial. In the reality, though, it is still not clear that ffmpeg will be returning in the near future.

The sticking point would appear to be security support. FFmpeg is seen by many as having rather more than its share of security problems; as a result, the Debian security team is nervous about adding ffmpeg support to their workload. It is worth noting that nobody has said that libav is better in this respect; indeed, Debian security team member Moritz Muhlenhoff stated that he thinks ffmpeg is more responsive to security issues than libav. The point is that either package brings in a fair number of problems to be solved, so doubling the load is not welcome. As Moritz put it last February: "for libav/ffmpeg this simply isn't manageable at all due to the huge stream of security issues trickling in".

There are a number of reasons why a project like ffmpeg (or libav) will have more than the average number of security-related problems. The library is directly exposed to potentially hostile data in the form of audio and video streams controlled by others. The number of formats to be supported is huge, and many codecs are written by developers who may not have security at the top of their list of concerns. Performance requirements can lead to hardware-specific code, sometimes done in assembly. Multimedia libraries find their way into a wide range of other applications, so a vulnerability can show up in unexpected places. It is thus not entirely surprising that a project like ffmpeg would have a relatively large number of security issues.

Even so, one might argue that the number is too large, and that the project should be doing better. The answer here is that, with some help from Google, both ffmpeg and libav are indeed trying to do better. In particular, the fuzzing work done at Google has led to over 1,000 separate bugs being fixed in ffmpeg. Many of those were security-related, of course; that, too, will increase the number of security fixes released by the project.

So ffmpeg should be getting better, and, by most accounts, libav is trying to follow the same path. That fact may calm some worries about accepting ffmpeg back into Debian in general, but it still is unlikely to make the security team feel better about its increased workload. So if ffmpeg comes in, it may well have to be at the expense of libav, a change that was not part of the posted plan for restoring ffmpeg.

If the debian-devel discussion is a proper guide, there will be few tears shed if ffmpeg edges libav out of the distribution. But, of course, there is a hitch here: the freeze date for the upcoming "jessie" release is a mere three months away. That is not a long time to replace a core library depended on by a large number of applications. If this replacement is to happen, it needs to start right away. If it does not happen soon, libav is likely to be the only option in Debian for another two years or so.

As of this writing, no clear resolution is in sight. There have been suggestions that this issue should be referred to the Debian technical committee, even though it cannot honestly be said that the requisite efforts to achieve consensus within the development community have been made.

Forks, if done right, can bring extensive benefits to both developers and users. The X.org fork of XFree86, for example, jump-started the development community and led to a rapid modernization of the code and increase in functionality. Three years later, it is not at all clear that the libav fork has succeeded in this way. Instead, it presents distributors with an unpleasant choice: either try to pick a winner or double up on an already extensive security update stream. Regardless of how it chooses, Debian is going to have a fair amount of work to do as it straightens out its short- and long-term plans regarding multimedia support.


to post comments

Reconsidering ffmpeg in Debian

Posted Aug 5, 2014 20:46 UTC (Tue) by marduk (subscriber, #3831) [Link] (3 responses)

For Gentoo, both libav and ffmpeg are supported, though they cannot both be installed simultaneously. Many programs will work with either, though upstream may only support one over the other. A few only support one or the other. It's nice that Gentoo supports either, but to the end user it's somewhat of a headache, especially if a user has to decide between package A and package B because one only works with ffmpeg and the other only works with libav. Or sometimes a program will work fine with one of them until a new version comes out and suddenly it doesn't, and there's no help from upstream because, well, they only officially support one of them and, guess what: it's not the one you're using.

Ideally these packages would either merge back into one or one should just die. As an end user I don't completely understand all the politics behind the fork but it is rather frustrating.

Reconsidering ffmpeg in Debian

Posted Aug 5, 2014 21:11 UTC (Tue) by josh (subscriber, #17465) [Link] (2 responses)

> especially if a user has to decide between package A and package B because one only works with ffmpeg and the other only works with libav.

Does anything only support libav at this point, other than libav's own tools?

Reconsidering ffmpeg in Debian

Posted Aug 5, 2014 21:52 UTC (Tue) by marduk (subscriber, #3831) [Link]

> Does anything only support libav at this point, other than libav's own tools?

I think in the Gentoo world, no. But sometimes upstream will only support one or the other.

For example, gstreamer's gst-libav plugin. It *used* to be called gst-ffmpeg. But upstream only supports libav now. Usually it works fine with ffmpeg. ffmpeg 2.3 comes out, now gst-libav doesn't work. User are forced to either stick with ffmpeg 2.2 or lower or switch to libav. Upstream doesn't officially support ffmpeg, so it will probably have to wait until Gentoo or someone else comes up with an unofficial patch.

Reconsidering ffmpeg in Debian

Posted Aug 12, 2014 12:00 UTC (Tue) by KotH (guest, #4660) [Link]

I guess you can consider VLC one of libav's tools...

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 5:39 UTC (Wed) by pabs (subscriber, #43278) [Link] (4 responses)

It would be really great if the libav people could just abandon it and merge all their changes/features back to ffmpeg. At this point it looks like ffmpeg won and resolved many of the issues that lead to the fork.

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 7:35 UTC (Wed) by jezuch (subscriber, #52988) [Link] (3 responses)

> At this point it looks like ffmpeg won and resolved many of the issues that lead to the fork.

Could someone remind us *what* led to the fork? I didn't realize it's been three years already...

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 11:26 UTC (Wed) by Siosm (subscriber, #86882) [Link] (2 responses)

Reconsidering ffmpeg in Debian

Posted Aug 12, 2014 11:55 UTC (Tue) by KotH (guest, #4660) [Link] (1 responses)

I would like to point out that this blog post, althoug often referenced, is a quite one-sided view of one ffmpeg developer. If you ask people on the libav side, they will tell you a different story.

Reconsidering ffmpeg in Debian

Posted Aug 12, 2014 12:15 UTC (Tue) by ux (guest, #98231) [Link]

In the beginning of the post, I explained the best I could what leaded to the fork and actually linked to Libav website (about page, where there is a history section), see "What went wrong" paragraph. This is unrelated to my preference to either project. I believe I added enough references in the post for people to check at the source.

I would guess that's what Siosm was pointed out to answer the question from jezuch.

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 9:58 UTC (Wed) by kugel (subscriber, #70540) [Link] (1 responses)

Perhaps people should stop thinking both libs are interchangeable and make them co-installable. So that upstream projects can run on the library they're supposed to run on.

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 14:46 UTC (Wed) by nevets (subscriber, #11875) [Link]

I guess the problem is that, as stated in the article, multimedia packages like these are prone to security issues. Having both installed at the same time just doubles your risk of security problems.

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 10:21 UTC (Wed) by przemoc (guest, #67594) [Link] (9 responses)

It's worth to read related wiki page written by mpv developers.
https://github.com/mpv-player/mpv/wiki/FFmpeg-versus-Libav

tl;dr FFmpeg is mostly superset of libav when it comes to features, but due to merges from diverging libav code base, to preserve being as compatible as possible, it's API is somewhat dictated by libav and there is some ABI bloat. OTOH FFmpeg can be seen as too easily accepting and putting new stuff in (not necessarily ready for wider audience).

And mpv is currently the best video player in Linux, actively developed with a lot of stuff cleaned and sanitized (and sometimes removed) from MPlayer+mplayer2's heritage. It has also encoding capability, but it's not feature complete yet.

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 12:38 UTC (Wed) by clump (subscriber, #27801) [Link] (6 responses)

I've been a happy user of mplayer for something close to a decade. Why is mpv the best in your opinion?

mpv / mplayer2

Posted Aug 6, 2014 14:15 UTC (Wed) by DonDiego (guest, #24141) [Link] (2 responses)

Just check out the homepages of mpv http://mpv.io/ and mplayer2 http://www.mplayer2.org/ and see for yourself.

mpv / mplayer2

Posted Aug 7, 2014 11:18 UTC (Thu) by akka (guest, #98110) [Link] (1 responses)

mplayer2 is not maplayer. Mplayer2 is a fork made partly by the same people that made libav

mpv / mplayer2

Posted Aug 7, 2014 11:26 UTC (Thu) by DonDiego (guest, #24141) [Link]

Yes, mplayer2 is not MPlayer, but mplayer2 has no relationship to libav. mplayer2 was created by Uoti Urpala, who is not a libav developer.

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 15:15 UTC (Wed) by mathstuf (subscriber, #69389) [Link] (2 responses)

I've contributed to mpv and it is certainly one of the cleaner C codebases I've worked with (up there with tmux, IMO). Implementing Matroska's ordered chapter support (AFAIK, the most complete FOSS implementation unless VLC finished something more recently; mplayer and mplayer2 both lack it) was a couple weeks of free-time work and testing. I'd like to get back to getting nested chapter support implemented, but it hasn't been on the top of my list.

Reconsidering ffmpeg in Debian

Posted Aug 7, 2014 11:42 UTC (Thu) by gidoca (subscriber, #62438) [Link] (1 responses)

> Matroska's ordered chapter support [...] mplayer and mplayer2 both lack it
The MPlayer2 website specifically lists Matroska's ordered chapters as one of the improvements over the original MPlayer.

Reconsidering ffmpeg in Debian

Posted Aug 7, 2014 13:39 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

Ah, I remember now. What is not supported is ChaperSegmentEditionUID which basically allows you to reference a specific chapter from another file directly. VLC and mplayer2 both will play complete files fine, but referencing chapters in external files just causes them to play the complete file. Try playing videos from this[1] directory.

[1]https://github.com/mpv-player/random-stuff/tree/master/ma...

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 19:45 UTC (Wed) by patrick_g (subscriber, #44470) [Link]

> mpv is currently the best video player in Linux

What are the advantages of mpv over VLC ?

Reconsidering ffmpeg in Debian

Posted Aug 7, 2014 11:21 UTC (Thu) by akka (guest, #98110) [Link]

the same link also has

<Although mpv attempts to work well with both FFmpeg and Libav, FFmpeg is preferred in general. This is simply because FFmpeg merges from Libav, and seems to have more features and fewer bugs than Libav. Although we don't agree with everything FFmpeg does, and we like some of Libav's general goals and development directions, FFmpeg is just better from a practical point of view.>

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 11:51 UTC (Wed) by rsidd (subscriber, #2582) [Link] (17 responses)

Forks are all very well, but what I dislike is this sort of message when I type "ffmpeg" in debian/ubuntu:
ffmpeg version 0.8.9-6:0.8.9-0ubuntu0.13.10.1, Copyright (c) 2000-2013 the Libav developers
  built on Nov  9 2013 19:09:46 with gcc 4.8.1
*** THIS PROGRAM IS DEPRECATED ***
This program is only provided for compatibility and will be removed in a future release. Please use avconv instead.
Suggesting that ffmpeg is deprecated/unmaintained, rather than leading a separate existence independent of the libav developers, is just sneaky.

command line tool deprecations

Posted Aug 6, 2014 13:27 UTC (Wed) by DonDiego (guest, #24141) [Link] (15 responses)

The ffmpeg command line tool was deprecated in favor of avconv to be able to move to an improved but incompatible command line syntax, not for "sneaky reasons" as you imply.

command line tool deprecations

Posted Aug 6, 2014 20:45 UTC (Wed) by ldarby (guest, #41318) [Link] (1 responses)

It reminded me of cdrecord's petulant error reporting:

cdrecord -scanbus
Cdrecord-Clone 2.01-dvd (i686-pc-linux-gnu) Copyright (C) 1995-2004 Jörg
Schilling
Note: This version is an unofficial (modified) version with DVD support
Note: and therefore may have bugs that are not present in the original.
Note: Please send bug reports or support requests to
...
Note: The author of cdrecord should not be bothered with problems in
this version.
scsidev: 'ATA:'
devname: 'ATA'
scsibus: -1 target: -1 lun: -1
Warning: Using badly designed ATAPI via /dev/hd* interface.

command line tool deprecations

Posted Aug 7, 2014 4:08 UTC (Thu) by rsidd (subscriber, #2582) [Link]

At least that text was inserted at Schilling's insistence.

command line tool deprecations

Posted Aug 7, 2014 4:07 UTC (Thu) by rsidd (subscriber, #2582) [Link] (12 responses)

There is very much a non-deprecated ffmpeg command line tool, it's just not from the libav project. If it had said "this ffmpeg command is not from the ffmpeg project, was provided by libav for compatibility, and is deprecated", that would be accurate. What it says is -- well, I said sneaky, but Siosm's link above calls it "a very destructive lie". Call it what you like, it's not nice.

command line tool deprecations

Posted Aug 7, 2014 14:38 UTC (Thu) by DonDiego (guest, #24141) [Link] (11 responses)

Libav moved to an incompatible command line syntax but kept a wrapper tool with the old syntax and the old name for a transition period. It is perfectly normal for such a compatibility wrapper to warn that its availability into the future is limited and what its replacement is.

FFmpeg merged all those changes and subsequently decided to take the new core and rename it back to the old name, dropping the compatibility wrapper. So there really are two avconv tools now, under two different names, from two different projects.

Why people get so worked up about a deprecation warning is beyond me. None of us care what the FFmpeg projects calls their command line tools. avconv(ert) is a more descriptive name IMO, but FFmpeg can certainly choose whatever name they prefer. It would be nice if we were granted that same freedom of renaming the tools we ship, doubly nice if we could add compatibility wrappers under the old name(s) to ease the transition for our users.

We don't make statements about the FFmpeg project in the output of our command line programs. If an FFmpeg developer constructs the output as "lies" about the FFmpeg project, well, I cannot help it.

There are two projects that both see themselves as the legitimate successor of the FFmpeg project from before the split. Both have had a command line tool called "ffmpeg" for multiple releases. Why we are not allowed to rename ours (and ship a wrapper) is beyond me. It is also beyond me why we should have to mention that our version is not from them. Yes, this Coca Cola was not produced by Pepsi. Their ffmpeg tool does not say "this is a renamed version of the avconv tool from libav" either.

Since you seem to consider this renaming charade so offensive maybe you should also go look at the other side: If you go to the FFmpeg download page at http://www.ffmpeg.org/download.html you will see news about releases that include the names and versions of included libraries. Conspicuously missing from that list is libavresample, which FFmpeg also ships but which originated in the libav project. There is a report in FFmpeg's issue tracker about the missing library version on the download page: https://trac.ffmpeg.org/ticket/3774 - the response is that libavresample is "unmaintained" and "should not be used". libavresample is very much maintained, just not by FFmpeg. Why should it not be used? Maybe because programs using libswresample instead become incompatible with libav?

So, what do you call that?

command line tool deprecations

Posted Aug 7, 2014 15:45 UTC (Thu) by rsidd (subscriber, #2582) [Link] (6 responses)

Libav moved to an incompatible command line syntax but kept a wrapper tool with the old syntax and the old name for a transition period. It is perfectly normal for such a compatibility wrapper to warn that its availability into the future is limited and what its replacement is.

It is not normal to do that when the unforked program with the same name still exists. It is as if LibreOffice forked OpenOffice (for perfectly good reasons), kept around the "ooffice" binary (again for perfectly good reasons of compatibility), but if you typed "ooffice", warned that OpenOffice was "deprecated" -- even though Apache OpenOffice was alive and well and making releases, despite admittedly being dormant earlier. Or maybe you don't see that as a problem.

Yes, this Coca Cola was not produced by Pepsi.

Since you bring up that analogy (and ignoring questions of trademarks) -- it is as if Pepsi forked from Coca Cola, produced a "similar" product called Coca Cola for a while, and then told people who asked for coke that "Coca Cola is deprecated and will be removed in the future".

maybe you should also go look at the other side [libavresample]

First, if other people act like jerks that doesn't mean you need to act like one. Second, ffmpeg (unlike libavsample) is meant to be used by end-users and it is unlikely that end-users will see the message you quote on the issue tracker page.

command line tool deprecations

Posted Aug 7, 2014 16:16 UTC (Thu) by DonDiego (guest, #24141) [Link] (5 responses)

> > Libav moved to an incompatible command line syntax but kept a wrapper tool with the old syntax and the old name for a transition period. It is perfectly normal for such a compatibility wrapper to warn that its availability into the future is limited and what its replacement is.

> It is not normal to do that when the unforked program with the same name still exists. It is as if LibreOffice forked OpenOffice (for perfectly good reasons), kept around the "ooffice" binary (again for perfectly good reasons of compatibility), but if you typed "ooffice", warned that OpenOffice was "deprecated" -- even though Apache OpenOffice was alive and well and making releases, despite admittedly being dormant earlier.

The program printed a deprecation message because the command line syntax changed, scripts might need to get updated, etc. This was not a case of just symlinking the two names.

Why do keep insisting that a simple heads-up message to users was done out of malice to spite a competing project?

Also note that "ffmpeg" (lowercase, command line program) is not equal to "FFmpeg" (mixed case, project name). While this might seem silly and inconsequential to you, nobody in either community confuses the two names.

> > Yes, this Coca Cola was not produced by Pepsi.

> Since you bring up that analogy (and ignoring questions of trademarks) -- it is as if Pepsi forked from Coca Cola, produced a "similar" product called Coca Cola for a while, and then told people who asked for coke that "Coca Cola is deprecated and will be removed in the future".

You argue from the asssumption that one of the two sides of the split is the original and the other is the fork. This is not the case here. Both sides claim to be the legitimate successors of the original FFmpeg project. Who forked who is very much disputed.

> > maybe you should also go look at the other side [libavresample]

> First, if other people act like jerks that doesn't mean you need to act like one.

Of course not, but you act as if one side is misbehaving here while the other side is not.

> Second, ffmpeg (unlike libavsample) is meant to be used by end-users and it is unlikely that end-users will see the message you quote on the issue tracker page.

So telling users that they may need to adapt to a new tool syntax is not OK, but telling developers that a library is unmaintained and should not be used is OK?

command line tool deprecations

Posted Aug 7, 2014 22:16 UTC (Thu) by ldarby (guest, #41318) [Link] (4 responses)

> Why do keep insisting that a simple heads-up message to users was done out of malice to spite a competing project?

Because that's precisely what it looks like to people outside your community.

command line tool deprecations

Posted Aug 7, 2014 22:37 UTC (Thu) by DonDiego (guest, #24141) [Link] (3 responses)

> > Why do keep insisting that a simple heads-up message to users was done out of malice to spite a competing project?

> Because that's precisely what it looks like to people outside your community.

Well, appearances can be deceiving.

command line tool deprecations

Posted Aug 8, 2014 17:52 UTC (Fri) by flussence (guest, #85566) [Link] (2 responses)

Let's assume the message in question wasn't written out of passive-aggressive spite, which is how most onlookers appear to have interpreted it. Let's also assume that libav doesn't want to join AOO and Xfree86 in the "how not to do PR" history book.

In this version of reality it would be a no-brainer to just quietly remove the offending message than to continue trying to justify it with increasingly ridiculous excuses. The damage to libav's reputation stops, new users turning to Google for a straight answer don't have to inadvertently discover that one Ubuntu bug or the entire bloody history of the libav project's existence. The project wouldn't even need to issue a public apology for causing confusion over this; people would just forget after a while.

But those are pretty huge and baseless assumptions, I'll admit.

command line tool deprecations

Posted Aug 8, 2014 21:21 UTC (Fri) by DonDiego (guest, #24141) [Link] (1 responses)

The message is long gone along with the compatibility wrapper program. It is only present in a very old release that receives nothing but critical bug fixes every once in a while. The developers only care about Git HEAD.

I'll be glad to hear your alternative wording suggestions. Make it express that the ffmpeg command line program has been deprecated in favor of the avconv command line program due to incompatible command line syntax improvements.

command line tool deprecations

Posted Aug 8, 2014 21:24 UTC (Fri) by mpr22 (subscriber, #60784) [Link]

I think "The ffmpeg command line program has been deprecated in favor of the avconv command line program due to incompatible command line syntax improvements.", with no obnoxious shouty caps, expresses that concept very well.

command line tool deprecations

Posted Aug 7, 2014 16:51 UTC (Thu) by ux (guest, #98231) [Link] (3 responses)

> FFmpeg merged all those changes and subsequently decided to take the new core and rename it back to the old name, dropping the compatibility wrapper.

FFmpeg merged avconv changes in his main tool called "ffmpeg" from the beginning. But ffmpeg also has a compatiblity layer for the old options, see opt_old2new() in ffmpeg_opt.c.

> Why people get so worked up about a deprecation warning is beyond me. None of us care what the FFmpeg projects calls their command line tools.

You suddenly seems to forget that Libav was (is?) packaged for years in debian under the package name "ffmpeg", and thus was suggesting the FFmpeg project was renamed (which is actually what the original post on lwn said).

FFmpeg didn't get renamed but continued being developed, and thus didn't renamed its main tool nor its libraries.

Libav is another new project, and kept the tool name for a while, and still has the same library names thanks to the confusing name of "Libav".

> There is a report in FFmpeg's issue tracker about the missing library version on the download page: https://trac.ffmpeg.org/ticket/3774 - the response is that libavresample is "unmaintained" and "should not be used".

Comment from Carl Eugen "fixed" in https://trac.ffmpeg.org/ticket/3774#comment:7

Sorry about that.

command line tool deprecations

Posted Aug 7, 2014 17:08 UTC (Thu) by DonDiego (guest, #24141) [Link] (2 responses)

> You suddenly seems to forget that Libav was (is?) packaged for years in debian under the package name "ffmpeg", and thus was suggesting the FFmpeg project was renamed (which is actually what the original post on lwn said).

> FFmpeg didn't get renamed but continued being developed, and thus didn't renamed its main tool nor its libraries.

You derive all the legitimacy of calling yourself the real FFmpeg project from somehow having got ahold of the domain name. There are two projects now, both of which see themselves as legitimate successors of the FFmpeg that was there before. Either both should have a claim to the title or none should. One side says it's a fork, the other a rename.

Complaining about this is just disingenuous. Pot, kettle, black...

command line tool deprecations

Posted Aug 7, 2014 17:35 UTC (Thu) by ux (guest, #98231) [Link] (1 responses)

> You derive all the legitimacy of calling yourself the real FFmpeg project from somehow having got ahold of the domain name.

The name of the project didn't change and continued its development under the same name, with less developers. Libav is a new project, with a new name, and thus should just assume its fork status. Note that there is absolutely nothing wrong about forking when it's done properly.

Actually, this is from https://libav.org/about.html:

> Later we have learned that the FFmpeg founder, who owns the domain, still favors the now-demoted project leader. We of course respect his opinion, which convinced us to fork "properly" under the name Libav

There is no point in arguying here that Libav is the original project since your official page states that it's a fork.

command line tool deprecations

Posted Aug 7, 2014 17:43 UTC (Thu) by DonDiego (guest, #24141) [Link]

As I said: both sides disagree and lay claim to being the legitimate successors of the original FFmpeg project.

Reconsidering ffmpeg in Debian

Posted Aug 7, 2014 11:33 UTC (Thu) by akka (guest, #98110) [Link]

I switched from debian to arch on my laptop when I got this message. I also thought is was a really ugly strategy.

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 16:49 UTC (Wed) by amit (subscriber, #1274) [Link] (4 responses)

It would be good for both the projects to have coverity run on them. That will find all the bad-code related bugs easily.

It won't find all the security bugs arising out of improper handling of input streams, but would at least flag places which rely on user-controllable input that look suspicious, and that will give the developers a thought about the security aspect there.

Also, after the heartbleed fiasco, coverity is gaining some smarts in recognizing places that accept user input, so it's only a good thing to point coverity to a codebase that handles a lot of potentially hostile input.

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 17:00 UTC (Wed) by JGR (subscriber, #93631) [Link]

ffmpeg and libav are non-trivial projects.
Expecting a tool to "easily" find all "bad-code" related bugs seems somewhat optimistic to me.
Arguably the bulk of ffmpeg/libav is in some way involved in handling user-controllable input (ie. audio/video input).

Reconsidering ffmpeg in Debian

Posted Aug 6, 2014 19:01 UTC (Wed) by markh (subscriber, #33984) [Link] (2 responses)

Both projects are already analyzed with Coverity.

ffmpeg: https://scan.coverity.com/projects/54
libav: https://scan.coverity.com/projects/106

Reconsidering ffmpeg in Debian

Posted Aug 7, 2014 16:27 UTC (Thu) by ux (guest, #98231) [Link] (1 responses)

See coverity fixes in FFmpeg: http://git.videolan.org/?p=ffmpeg.git&a=search&h=...

Coverity is quite nice BTW.

Reconsidering ffmpeg in Debian

Posted Aug 13, 2014 8:55 UTC (Wed) by ber (subscriber, #2142) [Link]

Coverity requires you to advertise for it and to not publish their detailed findings at their discretion (last time I've looked into their terms of service). This may be the reason I haven't found studies that compares it to other services. It would not be allowed right away. Also Coverity gets access to your evaluation of seriousness of security defects on their machines (located in the US I presume).
Those are significant drawbacks.

Made me look into stand-a-lone Free Software security checking tools like cppcheck, flawfinder or ASan/TSan/MSan.

A Voice from the Other Side

Posted Aug 6, 2014 18:37 UTC (Wed) by DonDiego (guest, #24141) [Link] (9 responses)

> He also mentioned ffmpeg's active developer community, implying by omission that libav's community is less so.

Libav is very much alive, churning out regular releases, daily commits, lots of activity on both the development mailing list and IRC channel, and new developers joining. All of the code from libav is merged into FFmpeg without credit or thanks, bolstering FFmpeg's perceived activity.

What libav clearly has less of is brand name recognition. One side of the split managed to grab ahold of the domain name and now presents itself as the original and true FFmpeg. The split created long-lived forks, none of the sides has more legitimacy in claiming to be the true FFmpeg than the other.

> The X.org fork of XFree86, for example, jump-started the development community and led to a rapid modernization of the code and increase in functionality. Three years later, it is not at all clear that the libav fork has succeeded in this way.

For better or worse, and for all the mistakes that are so easy to identify in hindsight, the split was the best thing that happened to FFmpeg in years. Not much different than with X.org vs. XFree86, the development community was jump-started and the code base rapidly modernized including an increase in functionality.

FFmpeg was poorly managed, stagnating, never made formal releases, had strict territorial code ownership, and a number of developers had stopped working on the project, leaving in frustration. Upsetting the dictatorial management structure brought them back and with them a lot of code and energy to work on the centerpiece of FOSS multimedia. Both projects have since moved to more modern tools and development practices.

Libav has led a big number of long-overdue overhauls of the library APIs, large-scale refactorings, and cleanups that included throwing away cruft and functionality that was not worth the maintenance burden. Before, attempts to do the same in the old project failed.

> In particular, the fuzzing work done at Google has led to over 1,000 separate bugs being fixed in ffmpeg.

The security issue is a complete red herring. It's quite simple really, both are horrid. Whether or not one has 1000 crashers and the other only 900 or the other way around is immaterial when the supply of bugs is basically infinite. If 1000 bugs get fixed, one should start to wonder how so many got there in the first place and how many more might be lurking.

Much of the old codebase was written during times when error checking was considered an optional nuisance or directly skipped to speed up decoding. Fuzzing is a great way to find bugs, but there is plenty to be found with good old grep or opening a random source file in your favorite editor and reading. Maybe we will live to see the day when the libraries are robust, but at this point it is very far off in the future. Adding all that error checking is not that much fun nor likely to make you rich or a featured celebrity.

Also note that many of the CVEs and bugs fixed in FFmpeg simply do not apply to libav or get fixed there in a more thorough fashion.

> compatibility problems between libav and programs like mplayer and the XBMC media center system.

Forget MPlayer, its successor mplayer2 and mpv, the successor of mplayer2, are much better. The codebase was cleaned up of old cruft while adding useful features. I put countless hours over many years into MPlayer, yet I'm not missing it. MPlayer did not age all that well, it is keeping its userbase and developers through gravity mostly. People don't switch because they have never heard of the alternatives. If MPlayer leaving Debian gives the alternatives a place in the spotlight, all the better.

XBMC (now called Kodi apparently) works with libav the last time I checked. In any case packaging Kodi/XBMC for Debian is going to be a gargantuan undertaking. Debian forbids embedded library copies of which XBMC has a metric gigaton.

> defenders of libav were mostly conspicuous in their absence.

Conspicuously absent are members of the libav community with the willingness or energy to join the next - this time on a Debian mailing list - trollfest. But unfortunately nobody seems to notice a lack of negativity, neither now nor at any of the previous occasions. People seem to prefer forming their opinion by reading mudslinging in random forums[1] rather than by reading patches, and by all accounts the mud does stick.

[1] No, this is not a thinly-veiled reference to lwn.net.

A Voice from the Other Side

Posted Aug 7, 2014 5:27 UTC (Thu) by tzafrir (subscriber, #11501) [Link] (4 responses)

The thread on debian-devel has mostly been a civil discussion. Yet I can't recall of a single valid argument that was raised there for keeping libav The only partial exception I recall "It's already in Stable. We have to keep it for as long as we support Stable anyway." which is somewhat valid, but may also be throwing good money after bad money (if libav is the worse choice of the two).

Oh: and that there's a single package (gstreamer-libav(?)) that only builds with libav and not with ffmpeg (while there are a number of other packages in the other direction).

Now, would you (or any other libav developer) kindly respond there? Or should Debian just replace libav with ffmpeg, given that no decent counter arguments were presented?

A Voice from the Other Side

Posted Aug 7, 2014 12:28 UTC (Thu) by Seegras (guest, #20463) [Link] (2 responses)

I think replacing libav with ffmpeg again is the right choice.

Yes, the fork was necessary, if only to keep the ffmpeg-developers on their toes, but I think ffmpeg is much the better choice now. I run debian, and I've used ffmpeg for maybe two years, since libav just did not have the necessary features.

A Voice from the Other Side

Posted Aug 7, 2014 14:42 UTC (Thu) by DonDiego (guest, #24141) [Link] (1 responses)

What features are you missing? I'm certainly missing nothing, as - arguably - are most people since either library versions are very featureful, but we are open to suggestions if you need/want something backported.

A Voice from the Other Side

Posted Aug 8, 2014 9:48 UTC (Fri) by jmm (subscriber, #34596) [Link]

mpv in Debian fails to decode vobsub subtitles, while is works with ffmpeg.

The libav bug is inactive for 1.5 years now: http://bugzilla.libav.org/show_bug.cgi?id=419

A Voice from the Other Side

Posted Aug 9, 2014 18:43 UTC (Sat) by tzafrir (subscriber, #11501) [Link]

A Voice from the Other Side

Posted Aug 7, 2014 11:28 UTC (Thu) by akka (guest, #98110) [Link]

If you look at MPVs site they say they support both but recommend ffmpeg?

A Voice from the Other Side

Posted Aug 7, 2014 16:23 UTC (Thu) by ux (guest, #98231) [Link]

> All of the code from libav is merged into FFmpeg without credit or thanks, bolstering FFmpeg's perceived activity.

Wrong:
• Every download here mentions Libav: http://ffmpeg.org/download.html#releases
• Libav is mentioned in the 2nd paragraph of our last release notes: http://git.videolan.org/?p=ffmpeg.git;a=blob;f=RELEASE_NOTES;...
• Every single commit from Libav is in a merge commit to keep full authorship, even if we don't actually merge the changes.

> Forget MPlayer, its successor mplayer2 and mpv, the successor of mplayer2, are much better.

MPlayer is still maintained, mplayer2 is completely dead since months.

A Voice from the Other Side

Posted Aug 7, 2014 21:25 UTC (Thu) by runekock (subscriber, #50229) [Link] (1 responses)

> The security issue is a complete red herring. It's quite simple really, both are horrid. Whether or not one has 1000 crashers and the other only 900 or the other way around is immaterial when the supply of bugs is basically infinite. If 1000 bugs get fixed, one should start to wonder how so many got there in the first place and how many more might be lurking.

>Much of the old codebase was written during times when error checking was considered an optional nuisance or directly skipped to speed up decoding. Fuzzing is a great way to find bugs, but there is plenty to be found with good old grep or opening a random source file in your favorite editor and reading. Maybe we will live to see the day when the libraries are robust, but at this point it is very far off in the future. Adding all that error checking is not that much fun nor likely to make you rich or a featured celebrity.

Uh-oh, sounds like both libraries are basically impossible to secure in their present states. If that is the case - and DonDiego certainly seems to know what he is talking about - then the Debian security team is providing a false sense of security by supporting (one of) the libraries.

Perhaps it would be better in this case to drop any pretense of security support on the distro level. For Debian, a way to do that would be to keep the libraries out of future stable releases, only providing them in e.g. unstable.

A Voice from the Other Side

Posted Aug 7, 2014 21:49 UTC (Thu) by mpr22 (subscriber, #60784) [Link]

Unfortunately, people want to play videos on their Debian stable systems without having to do some elaborate apt configuration dance.

Reconsidering ffmpeg in Debian

Posted Aug 8, 2014 22:16 UTC (Fri) by mhartzel (guest, #91618) [Link]

I'm a long time ffmpeg user and developer for a software package that uses ffmpeg functionality.

Forgive me for being blunt, but this fork really got to my nerves. The ffmpeg / libav maintainer forced libav down every Ubuntu and Debian users throat. This is unacceptable. The choice should have been left to users. I was forced to adapt my software for libav, since I have promised my software package works on Ubuntu and Debian. I was not happy for the extra work.

Yes, libav accelerated ffmpeg development, thanks for that. But now I hope libav just goes away. I can not accept the way libav treated users in this fork. A project should always put its users first. It is not ok to use confusing deprecation messages, or confusing runtime names. Its not ok to fork projects and use a similar name for the fork and claim it is the successor of the original project (mplayer / mplayer2). It is not ok to muddy the waters for the users or try to grab an existing userbase by force. Users must be earned by making good code and being respectable and trustworthy. Libav lost my trust by the way they made things hard and confusing for me as a user and developer.

This fork will go down to history books as an example of how not to do a fork.

Sorry for the rant, this is no troll. I was deeply touched by this fork, and it still brings up bad feelings.


Copyright © 2014, Eklektix, Inc.
This article may be redistributed under the terms of the Creative Commons CC BY-SA 4.0 license
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds