FFmpeg's April Fools: Moving to Rust, 10x Slower, For Your Safety

Level 1: The Race Car and the Tricycle

A famous race-car team keeps winning every race with a car they built and tuned by hand. Every day, strangers shout over the fence: "Your car is dangerous! Replace it with this new super-safe tricycle!" So on April 1st, the team posts a big announcement: "Great news! We're switching to the tricycle. We'll finish every race ten times slower, and also the car will only drive in circles — but safety first!" They're not actually doing it; they're imitating the fence-shouters to show how silly the demand sounds. The funniest part is how many people read it and gasped "wait, really?" — which is exactly what makes a perfect April Fools joke.

Level 2: The Cast of Characters

• FFmpeg — the open-source Swiss-army knife of audio/video: converting, decoding, encoding, streaming. If you've watched a video on the internet, FFmpeg code almost certainly touched it somewhere.
• C and Assembly — C is a fast, low-level language with manual memory management; assembly is raw CPU instructions written by hand. Both give maximum speed and maximum opportunity to shoot yourself in the foot with memory bugs.
• Rust 🦀 — a newer systems language (the crab is its mascot, Ferris) whose compiler mathematically prevents most memory-corruption bugs. Its enthusiastic community is affectionately/exhaustingly known for suggesting everything be rewritten in it.
• Memory safety — the property that a program can't read or write memory it shouldn't. Memory bugs in C are a top source of security vulnerabilities, which is why the suggestion isn't crazy — just delivered, often, without appreciating what it would cost this particular project.
• April Fools — note the timestamp in the screenshot: 01 Apr. The channel's own caption ("so at least you have some memories of this 1st of April") confirms it's preserved as a classic of the genre.

The junior-dev lesson: performance and safety are a trade-off space, not a moral hierarchy. The right answer differs between a web service parsing user JSON and a codec crunching 8K frames in real time.

Level 3: The Reply Guys Finally Got Their Answer

The verified @FFmpeg account, posted at 1:00 on 01 Apr 26:

FFmpeg is moving to Rust 🦀. Our use of C and Assembly in FFmpeg has been an unacceptable violation of safety. FFmpeg will be running 10x slower – but we're doing it for your safety. All your videos will appear green – safety first, working software later.

Every sentence is a precision strike on a real discourse. FFmpeg's maintainers have spent years fielding "Rewrite It In Rust" evangelism — drive-by suggestions from people who will never write a codec, aimed at a project whose hand-tuned C and assembly powers essentially every video pipeline in existence (YouTube, streaming services, your phone's gallery — all FFmpeg downstream). The account is famous for its sass, having publicly defended assembly optimizations against critics who called them obsolete. This tweet is that whole multi-year argument compressed into parody: "an unacceptable violation of safety" mimics the moralizing register of safety evangelism, where engineering trade-offs get reframed as ethical failings.

"All your videos will appear green" is the connoisseur's joke. A corrupted or missing frame buffer in YUV color space decodes as flat green — anyone who's debugged a decoder knows that green frame intimately. It's the visual signature of a rewrite that compiles, passes the borrow checker, and is wrong. "Safety first, working software later" inverts the actual priority of a tool whose entire mandate is producing correct output fast.

The top reply from CobaltDragon — "Could you please also fragment the release builds into at least 20 executables in a nested..." — extends the satire to the Rust ecosystem's packaging culture, where a hello-world pulls 200 crates. And the meta-layer: an April Fools joke only works when the premise is plausible enough to sting. Plenty of people read the first line and believed it, because real projects have announced Rust migrations to fanfare. The maintainers weaponized that plausibility.

Level 4: Why the Assembly Is Load-Bearing

To understand why this joke detonated 19.7K likes, you have to understand why FFmpeg is one of the few codebases on Earth where hand-written assembly is not vanity. Video codecs are dominated by tight inner loops — motion compensation, DCT/IDCT transforms, deblocking filters — operating on millions of pixels per frame. These loops are nearly perfect candidates for SIMD (Single Instruction, Multiple Data): one AVX2 instruction processes 32 bytes of pixel data at once; AVX-512 doubles that. The catch is that compilers are still mediocre at auto-vectorizing real codec code, which is full of saturating arithmetic, cross-lane shuffles, and unaligned access patterns that defeat the optimizer's alias analysis. So FFmpeg maintainers write the kernels directly in assembly, per architecture, and routinely beat compiler output by 2-8x. The project even maintains its own assembly school for new contributors.

This collides with Rust's value proposition at a fundamental level: memory safety is enforced by the borrow checker over Rust code — but a SIMD kernel, whether written in asm! blocks or via intrinsics, lives largely in unsafe territory anyway. Rewriting FFmpeg's C orchestration layer buys safety where exploits actually live (demuxers parsing untrusted container formats — a genuinely fair point the satire conveniently steamrolls), but the performance-critical 10% would remain exactly as unsafe as before, just with extra build complexity. The "10x slower" figure is comic exaggeration, but it gestures at a real asymmetry: safety guarantees are checked at compile time and cost nothing at runtime in theory, while in practice idiomatic-safe rewrites of hand-tuned kernels shed performance through bounds checks, missed vectorization, and abstraction layers until someone reintroduces the unsafe blocks — at which point you've rewritten a Ferrari into a Ferrari with a seatbelt sticker.