media-processing

2 posts

meta

FFmpeg at Meta: Media Processing at Scale (opens in new tab)

FFmpeg is central to Meta’s media infrastructure, running tens of billions of times daily. Meta’s heavily modified internal fork became difficult to maintain as upstream FFmpeg evolved, so the company collaborated with the FFmpeg community to upstream key capabilities. Threaded multi-lane transcoding and real-time quality metrics now allow Meta to rely entirely on upstream FFmpeg for VOD and livestreaming. ## Moving Away from an Internal FFmpeg Fork - Meta’s fork had diverged substantially from upstream while supporting specialized requirements. - Maintaining both the fork and newer open-source FFmpeg versions created: - Divergent feature sets - Difficult rebases - Increased regression risk - Collaboration with FFmpeg developers, FFlabs, and VideoLAN enabled the needed functionality to be integrated upstream. ## More Efficient Multi-Lane Transcoding - Meta creates multiple DASH encodings for each uploaded video, varying resolution, codec, framerate, and quality. - Running separate FFmpeg processes wastes resources by repeatedly decoding the same source and starting multiple processes. - A single FFmpeg command can decode once and send frames to multiple encoder instances. - Earlier FFmpeg versions still processed those encoders serially for each frame. - Improved parallel encoder threading, introduced from FFmpeg 6.0 and completed in FFmpeg 8.0, allows encoder instances to run concurrently. - The change reduces compute overhead across Meta’s more than one billion daily video uploads. ## Real-Time Quality Metrics for Livestreaming - Metrics such as PSNR, SSIM, and VMAF measure compression-related visual quality loss. - Traditional FFmpeg workflows calculate these metrics after encoding, which is unsuitable for live video. - Meta needed a decoder after each encoder to reconstruct compressed frames and compare them with the original frames during processing. - FFmpeg’s “in-loop” decoding, available beginning in FFmpeg 7.0, enables real-time per-lane quality measurement within one command. ## Deciding What to Upstream - Meta aims to upstream changes that provide broad value to FFmpeg users. - Infrastructure-specific patches are kept internal when they cannot be reasonably tested or used by the wider community. - Meta’s custom MSVP transcoding ASIC is integrated through FFmpeg’s standard hardware APIs, alongside NVIDIA, AMD, and Intel technologies. - Because external developers cannot access MSVP hardware, Meta maintains and validates those internal patches itself. ## Continued Investment in FFmpeg - Upstream improvements allowed Meta to retire its internal fork for all VOD and livestreaming pipelines. - Standardized hardware interfaces make it easier to combine specialized ASICs with software-based encoding and decoding. - Meta plans to continue contributing to FFmpeg to improve efficiency, reliability, codec support, and media experiences across the industry. Meta’s experience demonstrates that upstreaming broadly useful infrastructure improvements can reduce long-term maintenance costs while strengthening the entire FFmpeg ecosystem.

meta

Rust at Scale: An Added Layer of Security for WhatsApp (opens in new tab)

WhatsApp has deployed a Rust-based media security layer across billions of devices to defend against malware hidden in images, videos, PDFs, and other attachments. The system, called Kaleidoscope, validates file formats and identifies suspicious content before it reaches vulnerable downstream libraries. WhatsApp’s large-scale rollout demonstrates Rust’s production readiness and supports the company’s broader shift toward memory-safe languages. ## Media Handling as a Security Boundary - WhatsApp’s default end-to-end encryption protects messages, but shared media can still contain maliciously crafted files. - Attackers may exploit vulnerabilities in: - Operating system libraries - Media parsers - WhatsApp itself - Dangerous attachments can appear harmless, particularly when malware is concealed in images or videos. ## Lessons from the 2015 Stagefright Vulnerability - Android’s Stagefright vulnerability affected operating-system media-processing libraries. - Applications could not directly patch the vulnerable libraries, while users often took months to update their devices. - WhatsApp adapted its existing cross-platform C++ `wamedia` library to identify malformed MP4 files that could trigger vulnerable parsers. - This allowed WhatsApp to protect users faster than relying solely on operating-system updates. - Because the library automatically processes untrusted downloads, WhatsApp identified it as a strong candidate for memory-safe implementation. ## Replacing C++ with Rust - WhatsApp developed the Rust implementation alongside the original C++ version rather than performing a gradual rewrite. - Differential fuzzing, unit tests, and integration tests verified compatibility. - Key challenges included: - Increased binary size from the Rust standard library - Build-system support for WhatsApp’s many target platforms - The final implementation replaced approximately 160,000 lines of C++ with 90,000 lines of Rust, including tests. - Rust provided performance and runtime memory-use improvements. - The library was deployed across Android, iOS, Mac, Web, wearables, and other platforms. ## Kaleidoscope’s File Checks - Kaleidoscope expands beyond basic MP4 validation by checking for: - Non-conforming structures that could exploit parser differences - Embedded files and scripts in PDFs - Files that disguise their type through spoofed extensions or MIME types - Known dangerous formats such as executables and applications - These checks support safer handling in WhatsApp’s user interface and help defend against malicious attachments and unofficial clients. - The system cannot prevent every attack, but it adds an important defense-in-depth layer. ## WhatsApp’s Broader Security Strategy - WhatsApp distributes the libraries each month to billions of phones, computers, watches, and browsers across WhatsApp, Messenger, and Instagram. - The company describes this as the largest deployment of Rust code across diverse end-user platforms. - Its wider security program includes: - End-to-end encrypted messages, calls, and backups - Key transparency and additional calling protections - Fuzzing, static analysis, audits, and attack-surface monitoring - CVE reporting and an expanded bug bounty program - WhatsApp’s vulnerability strategy focuses on minimizing attack surface, strengthening remaining C and C++ code, and choosing memory-safe languages for new development. - Existing protections include control-flow integrity, hardened allocators, safer buffer APIs, specialized developer training, and automated analysis. WhatsApp plans to accelerate Rust adoption, particularly for security-sensitive, cross-platform components that process untrusted input. Its media library rollout provides evidence that Rust can deliver both memory safety and performance at global consumer scale.