OSS、安全与资金：libjpeg-turbo
4 分•作者: ternaus•大约 7 小时前
libjpeg-turbo 几乎是你电脑、手机或任何其他数字屏幕上看到的每一张图片的幕后功臣。<p>我在进行计算机视觉模型训练时也使用它。所有经过我模型处理的图片都需要解码。<p>我曾经对解码 JPEG 图片的 Python 库进行过一次基准测试：https://github.com/ternaus/imread_benchmark<p>所有顶尖的库都使用了 libjpeg-turbo。<p>该库经过了高度优化 => 我提交了一个 PR，带来了 3% 的小幅改进。虽然不算突破性，但聊胜于无。<p>该 PR 被拒绝了。<p>> 这不足以证明潜在的干扰是合理的。霍夫曼解码和部分图像解压多年来一直是该库中不成比例的安全问题来源。<p>> 谷歌在 2015 年贡献了部分图像解压功能，但十一年后我仍然不得不花费无偿的时间来修复它（包括几周前花费 18 个无偿小时修复 #915），而谷歌却对我六个月前获得的安保补丁奖励的付款置之不理。<p>> 与此同时，libjpeg-turbo 的一般基金负债累累，按照目前的补充速度，需要到 2028 年才能补足，而且这还是假设我不需要花费更多无偿的时间来修复新发现的错误。<p>> 像这样在细枝末节上做文章，不幸的是，对于像 libjpeg-turbo 这样受到严格审查且长期资金不足的项目来说，并不是一个好的选择。<p>----<p>也就是说，几乎所有使用互联网的人每天都在使用 libjpeg-turbo，但非常有影响力的工作却得不到报酬。<p>附注：我曾尝试通过 GitHub Sponsors 捐款，但没有找到该选项。<p>再附注：现在，用 LLM 重写别人的软件变得容易了……开源万岁。
查看原文
libjpeg-turbo is behind nearly every image you see on your computer, phone or any other digital screen.<p>I also use it during computer vision model training. Every image that goes through my model, should be decoded.<p>At some point I did a benchmark of python libraries that decode JPEG images https://github.com/ternaus/imread_benchmark<p>All top libraries use libjpeg-turbo.<p>The library is heavily optimized => I made a PR with a small improvement of 3%. Not groundbreaking, but small is better than nothing.<p>The PR was refused.<p>> That is not compelling enough to justify the potential disruption. Huffman decoding and partial image decompression have been the source of a disproportionate number of security issues found in the library over the years.<p>> Google contributed the partial image decompression feature in 2015, but I continue to have to spend unpaid hours fixing it 11 years later (including 18 unpaid hours fixing #915 a few weeks ago) while Google is ghosting me on a security patch rewards payment I earned six months ago.<p>> Meanwhile, the libjpeg-turbo General Fund is so far in debt that it will take until 2028 before it is replenished at the current rate of replenishment, and that assumes that I don't have to spend a lot more unpaid hours fixing newly discovered bugs.<p>> Playing at the margins like this unfortunately isn't a good fit for a project like libjpeg-turbo that is so heavily scrutinized and chronically underfunded.<p>----<p>I.e. Nearly everyone who uses internet uses libjpeg-turbo every day, but very impactful work goes unpaid.<p>P.S. Looked for a way to donate some money via GitHub sponsors, but did not find such an option.<p>P.P.S. And now, when rewriting other people's software with LLMs became easy... Long live OSS.