OSS, security and Funding: libjpeg-turbo

libjpeg-turbo is behind nearly every image you see on your computer, phone or any other digital screen.

I also use it during computer vision model training. Every image that goes through my model, should be decoded.

At some point I did a benchmark of python libraries that decode JPEG images https://github.com/ternaus/imread_benchmark

All top libraries use libjpeg-turbo.

The library is heavily optimized => I made a PR with a small improvement of 3%. Not groundbreaking, but small is better than nothing.

The PR was refused.

> That is not compelling enough to justify the potential disruption. Huffman decoding and partial image decompression have been the source of a disproportionate number of security issues found in the library over the years.

> Google contributed the partial image decompression feature in 2015, but I continue to have to spend unpaid hours fixing it 11 years later (including 18 unpaid hours fixing #915 a few weeks ago) while Google is ghosting me on a security patch rewards payment I earned six months ago.

> Meanwhile, the libjpeg-turbo General Fund is so far in debt that it will take until 2028 before it is replenished at the current rate of replenishment, and that assumes that I don't have to spend a lot more unpaid hours fixing newly discovered bugs.

> Playing at the margins like this unfortunately isn't a good fit for a project like libjpeg-turbo that is so heavily scrutinized and chronically underfunded.

----

I.e. Nearly everyone who uses internet uses libjpeg-turbo every day, but very impactful work goes unpaid.

P.S. Looked for a way to donate some money via GitHub sponsors, but did not find such an option.

P.P.S. And now, when rewriting other people's software with LLMs became easy... Long live OSS.

6 points | by ternaus 19 hours ago

4 comments