frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

OSS, security and Funding: libjpeg-turbo

5•ternaus•3h ago
libjpeg-turbo is behind nearly every image you see on your computer, phone or any other digital screen.

I also use it during computer vision model training. Every image that goes through my model, should be decoded.

At some point I did a benchmark of python libraries that decode JPEG images https://github.com/ternaus/imread_benchmark

All top libraries use libjpeg-turbo.

The library is heavily optimized => I made a PR with a small improvement of 3%. Not groundbreaking, but small is better than nothing.

The PR was refused.

> That is not compelling enough to justify the potential disruption. Huffman decoding and partial image decompression have been the source of a disproportionate number of security issues found in the library over the years.

> Google contributed the partial image decompression feature in 2015, but I continue to have to spend unpaid hours fixing it 11 years later (including 18 unpaid hours fixing #915 a few weeks ago) while Google is ghosting me on a security patch rewards payment I earned six months ago.

> Meanwhile, the libjpeg-turbo General Fund is so far in debt that it will take until 2028 before it is replenished at the current rate of replenishment, and that assumes that I don't have to spend a lot more unpaid hours fixing newly discovered bugs.

> Playing at the margins like this unfortunately isn't a good fit for a project like libjpeg-turbo that is so heavily scrutinized and chronically underfunded.

----

I.e. Nearly everyone who uses internet uses libjpeg-turbo every day, but very impactful work goes unpaid.

P.S. Looked for a way to donate some money via GitHub sponsors, but did not find such an option.

P.P.S. And now, when rewriting other people's software with LLMs became easy... Long live OSS.

Comments

ternaus•3h ago
https://github.com/libjpeg-turbo/libjpeg-turbo/issues/918#is...
socialnewss•3h ago
great

Ask HN: My recent show HN post got flagged need guidance

4•theguysudo•1h ago•5 comments

Knowledge Refresh for Production RAG

2•rajkumarsamra•4h ago•0 comments

OSS, security and Funding: libjpeg-turbo

5•ternaus•3h ago•2 comments

Ask HN: How do you interview devs in a post-AI world?

42•mdwelsh•1d ago•33 comments

Ask HN: Diablo 4 on Ubuntu?

3•herodoturtle•16h ago•7 comments

Ask HN: How to recover Google auth after phone stolen?

117•keymasta•3d ago•128 comments

Some Thoughts on the Economics of UPI and MDR

5•pyeri•1d ago•0 comments

Ask HN: Remember N8n? Anyone?

9•sankalpdomore•2d ago•7 comments

Neovim have a ~$800k Bitcoin donation sitting untouched since 2023

315•jakemanger•3d ago•270 comments

Ask HN: Anyone using DeepSeek Harness (dsh) as part of a customer-facing agent?

5•mmartindevelope•1d ago•0 comments

Ask HN: Losing motivation to work in the IT field, need advice

21•trowa159•1d ago•24 comments

My Thoughts on AI and LLMs

13•leonardovb•2d ago•23 comments

Ask HN: ICLR went from 143 submissions to 62,301 submission IDs – what happened?

8•luxshan_t•1d ago•5 comments

Ask HN: What is the most career altering course or book you have gone through?

25•learner_yearner•4d ago•26 comments

ESP32 p4 pico and IMX477 camera

5•time-q•2d ago•1 comments

Ask HN: What happens when Claude Code goes away?

7•HoldOnAMinute•2d ago•21 comments

Does this mean it's fine to use Claude subscriptions with third party harnesses?

4•jakemanger•2d ago•1 comments

Ask HN: Co-Founder(s). Do I need any? How would I even find them?

15•bhollan•3d ago•17 comments

Open-sourced jev architecture last year with model,paper and dataset

88•nandakishor_ml•4d ago•15 comments

You've reached the end!