The XZ fiasco has shown how a dependence on unpaid volunteers can cause major problems. Trillion-dollar corporations expect free and urgent support from volunteers.
Kieran criticizes the asymmetry where trillion-dollar companies like Microsoft expect free, urgent support from volunteer-run open source projects, using the XZ backdoor incident and a Microsoft Teams bug report as examples. ✦ AI generated
Kieran Kunhya · Lex Fridman · 2026-05-06 · original ↗
starts at this moment · 117:47
“Can you explain the XZ fiasco?”
The XZ fiasco has shown how a dependence on unpaid volunteers can cause major problems. Trillion-dollar corporations expect free and urgent support from volunteers. Microsoft, Microsoft Teams posted on a bug tracker full of volunteers that their issue is high priority. After politely requesting a support contract from Microsoft for long-term maintenance, they offered a one-time payment of a few thousand dollars instead. This is unacceptable.
verbatim transcript · starts at 117:47
117:40variants because it has iOS, it has tvOS. - Well, I'm looking at a page fate.ffmpeg.org. 81 minutes ago, 76 minutes ago, looking at the different architectures, the operating systems, the different compilers, Apple Clang version... - Combinations are crazy. - ... the combination is insane. RISC- - So these are all run by volunteers, so these are all volunteer systems. The ones at the top, for example, the Macs I host in my office, for example,
118:07Host all sorts of different stuff. Other people host other things. So it's really there to make sure... because FFmpeg does quite complex C code, for example, you do have miscompilations. So the compiler will sometimes compile C code incorrectly. For example, this happens once in a while. - Oh, there's like, there's a log of all the compilations. - Yeah, log of all the compilations, all the tests. I think one of the other ones will show all the tests
118:32passing. - If you click, you can see all the tests- ... back. All tests successful. - In logs test, yeah. So you see all those tests are passing of all the different codecs, all the different filter transformations, all the- The level of scale is quite crazy. - Oh, that's nuts. - On all the combinations. It's not just a matrix at this point. It's like a pivot table
118:54of different combinations. - That's nuts. - And it's a key part of what we do because you may be able to test something locally, you make a change, but actually that breaks GCC version 11 on Mac or something like that, and you're able to then fix that. We also have miscompilation, so the C code, sometimes the compiler can have a bug in it where it creates the wrong output,
119:16and that can have quite a big effect sometimes on a video because of the way frames have dependencies. Even a small change in the output can cascade to actually quite big glitches. - You see PowerPC, you see RISC, you see ARM. - There was PowerPC, there was RISC, there was weird stuff in the past like DEC Alpha. There was— - You see Visual Studio, different versions of Clang or GCC.
119:37- Visual Studio, Intel compiler, Apple Clang, you name it. - What are some of the pain points? Like maybe do you have emotional triggers maybe nightmares about a particular operating system, a particular container, codec combination of- - I mean, for me, it's really easy because I have a day job. My company builds... The company I started builds equipment for broadcasting sports matches between TV stadiums and studios, for example.