Or they might decide the devs are unable to be contacted and the vulnerability should be immediately released.

It used to be 30 days. Apple and Microsoft complained because it didn't give enough time to analyze the problem, fix it, test it, and then do a proper rollout to ensure there weren't unexpected side effects in 30 days.

I think what happened was a kernel flaw, meaning a fix could severely impact other subsystems in the OS and thus a fix would need to be carefully done and a properly staged rollout.

The problem isn't the AI tools - Project Zero has real researchers doing real analysis and making sure those AI i

I think the overall quantity of this sort of thing means you need to fix the issue to avoid further slop. Even if WONTFIX stops Google from re-reporting the bug (a big IF), it won't stop other entities from running the same sorts of checks.

It's an overwhelming rush of stupid niggling details that don't really matter but will ultimately create too much work if it's unaddressed. Like if you have a web app and everyone's complaining about the color scheme, you should fix the color scheme even if it doesn't mat

Because someone still has to take time to read the slop. Over and over. That's the kind of thing that makes volunteers go volunteer somewhere else. And this shit is going to snowball; if Google keeps getting away with it so will other companies, then it will be students testing out their AI hacking skills. It’s better to send a public message to Google before the situation gets bad.

The problem is one of outsourcing. All these well-funded organisations are building their products on top of FOSS and making the maintainers work for them for free. On top of treating them like free workers they then start placing demands on the timeliness of fixes. I don't think it's unreasonable for FFmpeg and other similarly abused projects to start expecting funding.

> You're not writing to be compensated, you're writing to "scratch an itch".

True, but with many popular OSS projects, that "itch" becomes a permanent rash (constant demands for features/fixes, unpaid) that drive developers to burnout.

So then there's really only a few choices:

1. close the source, or also use a less permissive license that perhaps requires paid contract for commercial use etc.

2. large companies whose products depend on those projects help fund it, or,

3. dev burns out, leaving the project in limbo (or a bunch of proprietary forks) making it less popular/supported.

A company like Google could even contribute quality fixes, but by humans. Asking volunteers to solve a problem that the multi-million dollar company is benefiting from is cheap and spiteful, especially if said company provides no value to the project.

Google appears to have understaken the expense of spinning up an ocean-boiling slop machine to automagically generate plausible bug reports, and then casually fire off an email to the maintainers.

Note that Google has not undertaken the expense of assigning an engineer to also write a fix.

That they are not doing that is a conscious, management-approved choice.

...Y'know how Google relishes in closing bug reports with "WONTFIX - Working as designed?" I think FFmpeg should close slop reports from Google with, "WONTFIX - Unfunded."

Yeah, in this case the people running FFMPEG on a console from 1995 can address the security problem if they think it's needed.

So why wait at all just release the bugs you found. So if you find a vulnerability in Chrome don't even bother sending an email to Google. Eventually Google will find out and fix the bug. /s

Companies are notorious for not recognizing the derived value they get from open source software and recognizing that if they want to keep using them without taking on the burden of self-maintenance, they should pony up some funds to those who are maintaining it. The managers with the ability to spend funds have binders on resulting in vary narrow vision.