If Google Really Worries About “Zero Day Security Issues”, It Will Deprecate WebM Support, Not Ogg Theora Support
Reprinted with permission from Ryan Farmer.
Google Announces End of Support for Ogg Theora. Cites “Zero Day Security Issues” in Media Codecs; Forgets to Mention Their Own Codecs are the Problem.
Google has announced the “end of support” for Ogg Theora.
They claim it’s not widely used.
Wikipedia is one site that used it extensively, but Google moles are filling the site up with Googleisms so that nobody can access parts of Wikipedia without support for media codecs which have had some of the worst security disasters ever found in media codecs lately. libvpx and WebP, both Google formats.
There’s only 5 security vulnerabilities in the MITRE CVE database that even mention Theora, and the last one was in 2011.
Meanwhile, Google’s libvpx has 24 and its WebP image format has 34.
There isn’t really anything to prove Google’s claim that there is some imminent danger from Theora. It’s a much simpler and well-written codec. It’s also been around longer.
Google has, however, proven that it proliferates new formats, is incapable or unwilling to properly debug, them and then by the time they even start to get used on the Web, they’re off to something else.
There’s a lot of media codec attack surface in Chrome and that’s mainly because of Google adding new formats that are pointlessly different.
It’s also not clear at all that AV1 or WebM are free of legal dangers.
When the MPEG-LA threatened everyone using VP8 (a Google format), Google quietly paid them off so they would shut up. Who even knows what the REAL situation is with AV1 and WebM? Google won’t tell you.
The only thing we do know is that they’re way less than 20 years old and by the time patent trolls come out of the woodwork and start suing everyone over them, Google will have made sure that nobody can go back to using Theora even if they want to.
There is no longer a functioning W3C.
Years ago, Apple convinced them to drop Theora from the HTML 5 standard because the truth is that Theora is nearly as high quality as h264, but they were doubtful even in 2010 that they could sue over it.
Now we get to deal with Google’s “Intent to Ship” notices instead of Web standards that anyone can implement.
Also, as reported by Google, Mozilla is discussing, privately, whether to drop Theora.
Whether they do or not is irrelevant because basically nobody uses Gecko anymore, and even if they do, it’s irrelevant because it is developed behind closed doors, by a company that is as independent of Google as Belarus is of Russia.
Gecko is also not “true open source”. You can compile a version yourself, but all the development decisions happen behind closed doors. It’s more like “source available”, but the fork control is that you’ll never make significant improvements to the code and keep up with them. Like, Pale Moon even admits, again, that it will have to rebase and lose Unified XUL Platform.
No discussion is tolerated on Mozilla Bugzilla.
They use Google Groups marked Private (no mailing lists), they don’t even have IRC anymore.
Mozilla is hopelessly fucked and anyone saying it is not is delusional, and with all three people that still use their pile of spyware and adware, they have no power to enforce any decisions they even try to make to go another way with the Web platform.
Firefox and Gecko effectively ceased to exist a long time ago, in the sense that anything Mozilla does even matters.
For the last ten years, they were an investment Google made in case of an Anti-Trust trial, which is going on now. The search royalties made less and less sense as all of the Firefox users left, but they make perfect sense in a “We’ll prop you up as long as you don’t do anything to really get in our way and smile for the judge.” way.
They’re comparable to a nearly bankrupt and ruined Apple being reanimated by Microsoft in the 90s to say they had some really terrible competition for Windows, but it was something you could use.
Even I gave up and moved to Brave, which rips out and modifies a lot of the pollution that Google’s ad business throws into Chrome.
Theora is not a bad codec.
It runs faster on the decode side than h264, the code is decent, and it does almost as well (post-Thusnelda improvements) as h264 in coding efficacy.
Google is projecting all of the design mistakes, patent mess, and security holes in its own projects on something that has never had any huge problems.
I would have been happy if Theora and Ogg Vorbis became widely used, but the problem with technologies like these is it’s whatever the porn and pirate scene do that gets the codecs out there and widely used. MP3 would have failed without pirates, and the pirates are basically pushing HEVC and AAC now.
To be sure, Google does deserve some credit. Things could be much worse if HEVC ever made it onto the Web, and I’m not talking about some server that sends it to Safari, because honestly, who cares?
Google could have just paid the extortion within the context of Chrome and let it get out there and become a huge mess for everyone.
The compression efficacy of HEVC is actually not that much better than h264, but the patent mess is designed to basically go on forever when h264 patents are dying by the hundreds and closer to the end.
The CPU requirements if you have no hardware decode on HEVC are also very very bad, and the encode times are also very bad even with reasonable hardware.
My favorite thing about Theora was mainly just how fast it had CPU decode even in 2004.
Nobody designs these modern codecs to be simple, they design them to do stupid pointless things to get patents, and then you have to live with that. They’ve always done this to some extent, like MP3, but it’s gotten out of control so that they can get 50,000 patents.
Who wants to use software that was designed to waste their processing resources to make it more patentable? I don’t. █