FFmpeg was right: Google dumps LLM-found vulnerabilities on unpaid OSS maintainers
Bedrovelsen · x · 2026-11-15
Security researcher MalwareTechBlog argues FFmpeg's earlier public frustration was one of the most justified "crash outs" in infosec history. The core problem: cybersecurity is deeply unbalanced — roughly 1,000 people pointing at problems for every 1 fixing them.
Vulnerability research has become a marketing stunt, first with fuzzers and now with LLMs — "look what my new toy can do" rather than earnest attempts to fix security issues. He calls Google's behavior especially egregious: a $3.6 trillion company spent billions building a bot that finds bugs extremely fast, then dumped them all on unpaid open source maintainers, who under Google's 90-day disclosure policy must fix them within 90 days. Quoted context adds: FFmpeg was right all along and people gave them too much grief for it.
More from Safety
- Chinese Firms Smuggle Nvidia Chips While Beijing Bans Them — Hawk Consensus — theteknosaur · 2026-11-15
- Ramez: Highest-Benefit AI Policy Is Forcing Labs to Disclose Research Data — latticecut · 2026-11-15
- Debate over frontier lab NDAs: '永久 gag clauses should be illegal' sparks AI safety argument — davidmanheim · 2026-11-15
- rea + mitmproxy: a 60-second workflow that makes Claude Code expose what your apps are phoning home — Kyrannio · 2026-11-15
- DEFCON Talk Shows AI Makes Hacking IoT Devices Easier Than Ever — Kyrannio · 2026-11-15
- EU needs €500bn AI investment, von der Leyen says, to cut reliance on US and China — TobyWalsh · 2026-11-15