On 2/1/2025 7:27 PM, Michael Niedermayer wrote:
Hi JamesOn Sat, Feb 01, 2025 at 10:30:21AM -0300, James Almer wrote:On 1/31/2025 9:49 PM, Michael Niedermayer wrote:[...]has worked. Changing it now because one person was unhappy with a CC (ThatThis is a false statement. Iam not suggesting a change to the GA because of one CC iam suggesting a change because it is vulnerable to an attack. (The CC isnt even fixed by this, i think the concept of a CC elected out of a community thats full of mutual hate is a bad idea) But back to the topic, what do you suggest to fix the vulerability in the GA ? Or you dont care?Why do you say there's a vulnerability in the GA?The FAQ describes how to exploit it. And i belive others independantly found this issue as well.Has it been exploited forGiven the nature of this vulerability, its very hard to detect it being exploitedthis to be an issue?While active eploitation, certainly makes an issue worse. In general and especially when exploitation is not detectable, this is something we cannot wait forDid someone to your knowledge buy a developer to write 20 commits and get them into the GA?Lets be carefull here with the words. But the awnser is "yes" Many developers have been paid to write commits. employees, contractors, students Do i know of someone being asked after that to vote in a specific way ? No, how could i know other peoples private communication Have people asked me how/if they should vote ? Yes, some people did ask. In general "few time" outside contributors being payed to do some work dont care about the votes, they come, do some work and leave. I would expect the random subscriber of 2000 on ffmpeg-devel to care more as they follow the list for a long term they care more about the consequences
But what are the chances they'd get into the GA? Few-times outside contributors rarely submit more than a couple patches to implement the work they were paid for to do. Hardly 20 commits. And we could always stop asking people to split their patches into several different smaller patches (cosmetics, refactoring, etc) to reduce the chances of one time contributors from meeting the GA requirements.
Looking at the current GA, do you see anyone in it who wrote code for their employer, met the requirements, and stopped being active after their work was upstreamed?
Otherwise, you're making a big deal out of an hypothetical, and that's really damaging to the project.I don't know if you realize, but you're being incredibly disrespectful with almost everyone who has contributed anything in the last decade, treating them as moles trying to bring down the project instead of contributing to its success.I would appreciate if you keep this emotional drama out. We need to look with a clear head at this. Noone is disrespectful to people using ssh if ssh is vulnerable.
It's not emotional drama, it's a fact. By your own admission you consider the GA, composed of almost every currently active developer, untrustworthy, vulnerable and in need to be scrapped or repurposed, with nothing to back that distrust other than hypotheticals about being an attack vector. Is that not being disrespectful to the people in it?
A potential "attack" to the GA can be worked around, as exemplified above. To request a complete redo of the system, arguments and actual events with considerable weight are needed. Otherwise, as i mentioned before, it will be perceived as someone asking for changes because they are unsatisfied.
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
