Well the problem is that policy makers and large industrial companies HAVE heard of it, and think it is "what is happening in Europe". And they should stop thinking that, hence this article.
No, not really - however, based on this post, several people contacted me with questions like these. I asked around and got recommended https://www.amazon.co.uk/Cyber-Persistence-Theory-Redefining... for a more theoretical basis. Haven't read it yet though.
https://github.com/berthubert/trifecta/blob/main/README.md#k... has a list. The most painful one for me is that I did not know .svg files can contain javascript that gets executed in the site context if you can get someone to click on a link to your .svg file!
Yes, parts of this law are very likely to be struck down by the European Court of Human Rights, if a case ever gets there. Specifically the 100% automatic powers to hack and intercept anyone who is hacked by state backed hackers are pretty unlikely to be legal under the ECHR.
It has already been announced that this law will likely be extended. They later walked that back, but did admit that it is entirely possible to extend this law.
Hello! Well it made some difference, the law was toned down a bit, and it all caused a lot of noise. Also, the government has now sent out various legally binding letters on how they will not use the law. I suspect that will have reduced the enthusiasm for doing more stunts like this. Also, the law still isn't law and is currently languishing in the upper house of our parliament. So still an ongoing story!
So you might be able to turn this into your advantage. The zillion people embedding your great work will be on the hook if it turns out they haven't performed sufficient due diligence on ffmpeg. And who knows, you might get them to sponsor you to get security audits or documentation done. Could be their "ticket out of jail" one day!
Author here - the protections remain in theory, but will not longer be active beforehand. It is possible that the oversight committee finds the time to check afterwards, but they aren't obliged to do so. Also, by then the damage is done.