[FFmpeg-devel] [WIP] False positives on Coverity

[Timo Rothenpieler]

On 10.06.2024 14:37, Vittorio Giovara wrote:
> On Mon, Jun 10, 2024 at 12:04 AM Michael Niedermayer <michael at niedermayer.cc>
> wrote:
> 
>> On Sun, Jun 09, 2024 at 03:10:09PM +0200, Vittorio Giovara wrote:
>>> On Sun, Jun 9, 2024 at 12:50 AM Timo Rothenpieler <timo at rothenpieler.org
>>>
>>> wrote:
>>>
>>>> On 08.06.2024 21:49, Vittorio Giovara wrote:
>>>>> On Sat, Jun 8, 2024 at 6:02 PM Michael Niedermayer <
>>>> michael at niedermayer.cc>
>>>>> wrote:
>>>>>
>>>>>> On Tue, May 14, 2024 at 01:38:16AM +0200, Michael Niedermayer wrote:
>>>>>>> Hi all
>>>>>>>
>>>>>>> To keep people updated (and as this is not vissible on the ML)
>>>>>>> heres my current list of issues marked as false positives /
>> intentional
>>>>>> in Mai & April 2024
>>>>>>> (in case anyone wants to review, i presume noone wants but just in
>>>> case)
>>>>>>
>>>>>> updated list as of today:
>>>>>> [...]
>>>>>>
>>>>
>>>> Given the insane amount of them, I'm not a fan of that.
>>>> It produces more false positives than anything else.
>>>> It also has its own internal tracker for them, so flooding any kind of
>>>> other issue tracker with it seems just like point spam to me.
>>>>
>>>
>>> Not everyone has access to it. Also I'd rather have a trackable system
>> than
>>> a mail with a list of issues.
>>
>> every FFmpeg developer or maintainer who wants to work on these issues
>> can get access.
>>
> 
> and
> 
>> And last but not least coverity isnt intended to be public because it can
> find security issues.
> 
> are contradictory.
> 
> In either case, my point is that email is not a good system for these
> reports, because they cannot be tracked nor analyzed, and if they do pose a
> security risk they shouldn't be advertised so openly. Having a small bounty
> with STM funds would probably be a more efficient way at fixing them than
> asking people to take a look at them on the ML.

I'm not sure what you mean.
E-Mail is not the primary system for these reports.
They're just notifications about new stuff, with a rough summary of each 
issue, if there aren't too many.
The primary way to track and handle them is via their website.