arihi :bocchi_arch: :naima_padoru: :blobcatchristmastree: :ibrs2: :ene: :adorizz: :ruby_happy: on Nostr: even if there are no blobs in source, i feel like a program flow that one does not ...

even if there are no blobs in source, i feel like a program flow that one does not understand (especially the abundance of crypto functions with 30-line ifdef chains and various variables with matrixes that one might not be familiar with) leaves enough room for something sketchy to be going on eventually. these projects are maintained but it's hard to say whether the maintainers are playing the long game. i'm not saying that bento4 is sus, it very well seems legitimate, but i can't be sure because of the complexity.

i could have a vm that receives data and then sends back the result, but if the program was malicious is there anything stopping the program from making the output malicious too? maybe it's a bit too paranoid but it seems like in a scenario where bento4/gpac were attempting malicious stuff, they could do something to malform the video into output that triggers when ffmpeg/mpv/vlc plays it. i guess that applies to any file online though, as i don't know how it was created.

for my use case the mp4box from gpac was enough as it can do decryption too. the documentation just kinda sucks.

i went to a mailing archive on debian when researching gpac and the consensus was "it's vulnerable, let's drop it", so no patent issues:
https://lists.debian.org/debian-lts/2022/04/msg00018.html
https://tracker.debian.org/pkg/gpac