OSS, security and Funding: libjpeg-turbo

Original Summary

libjpeg-turbo is behind nearly every image you see on your computer, phone or any other digital screen.I also use it during computer vision model training. Every image that goes through my model, should be decoded.At some point I did a benchmark of python libraries that decode JPEG images https://github.com/ternaus/imread_benchmarkAll top libraries use libjpeg-turbo.The library is heavily optimized => I made a PR with a small improvement of 3%. Not groundbreaking, but small is better than nothing.The PR was refused.> That is not compelling enough to justify the potential disruption. Huffman decoding and partial image decompression have been the source of a disproportionate number of security issues found in the library over the years.> Google contributed the partial image decompression feature in 2015, but I continue to have to spend unpaid hours fixing it 11 years later (including 18 unpaid hours fixing #915 a few weeks ago) while Google is ghosting me on a security patch rewards payment I earned six months ago.> Meanwhile, the libjpeg-turbo General Fund is so far in debt that it will take until 2028 before it is replenished at the current rate of replenishment, and that assumes that I don't have to spend a lot more unpaid hours fixing newly discovered bugs.> Playing at the margins like this unfortunately isn't a good fit for a project like libjpeg-turbo that is so heavily scrutinized and chronically underfunded.----I.e. Nearly everyone who uses internet uses libjpeg-turbo every day, but very impactful work goes unpaid.P.S. Looked for a way to donate some money via GitHub sponsors, but did not find such an option.P.P.S. And now, when rewriting other people's software with LLMs became easy... Long live OSS.

情报分类：服务器与云资源
分类依据：内容涉及服务器、云资源或网络线路
信息来源：Hacker News 新项目
发布时间：2026/9/21 13:00:09

Original Summary

发表回复