[FFmpeg-devel] [PATCH 3/4] doc/faq: Document the plan ahead for Governance

[Nicolas George]

Michael Niedermayer (12025-01-07):
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  doc/faq.texi | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/doc/faq.texi b/doc/faq.texi
> index 54c3fbb41fe..70002a8156d 100644
> --- a/doc/faq.texi
> +++ b/doc/faq.texi
> @@ -702,4 +702,12 @@ In recent years, a significant number of developers contributing to the project
>  unlike in the past. These employees are often compensated for specific tasks, and the voting rights,
>  much like the copyrights, can typically be controlled by their employers.
>  
> + at section What is the future plan for FFmpeg Governance?
> +
> +Governance has 2 goals, 1st to make good decissions for FFmpeg. And 2nd is to create
> +an inclusive and motivating environment where contributors feel valued and inspired to
> +collaborate. The plan is to find out how to achieve these goals.
> +For example for a system to make good decissions it needs to be hard to manipulate
> +
> +

I agree with others that this is not a good idea.

If a feature has a severe security flaw like that, then we should not
document that security flaw prominently, it might give ideas to people
who had not noticed.¹ The feature should be just disabled until it is
fixed; and if fixing it is not possible because the security flaw is
inherent then the feature should just be dropped, possibly to be
replaced by a completely different approach.

Same goes for patch #2 in this series.

1: For the same reason, I have always refrained from explaining how to
legally ship GPL ffmpeg with a proprietary binary.

Regards,

-- 
  Nicolas George