Dev Police retweeted
I am the main developer fixing security issues in FFmpeg. I have fixed over 2700 google oss fuzz issues. I have fixed most of the BIGSLEEP issues. And i disagree with the comments @ffmpeg (Kieran) has made about google. From all companies, google has been the most helpfull & nice
Dev Police retweeted
And no, "you have to use asm for performance anyway" is not an excuse, because the security vulnerabilities are almost never in the asm code, they're in the C code that calls it. Keep writing the asm, that's not the problem.
Dev Police retweeted
Please don't tag me in programming language flamewars.
Expecting volunteer-run projects to always address CVEs quickly is not reasonable.
Promoting unsafe languages for popular libraries that have huge attack surface is not responsible.
Two things can be true at once.
Dev Police retweeted
I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)
github.com/amlweems/xzbot
