FFmpeg vs Google: Twitter drama explained by FFmpeg developer (who runs the FFmpeg X account)
FFmpeg developer Kieran discusses the Twitter drama surrounding Google's AI-generated security reports on FFmpeg, arguing that automated vulnerability discovery without corresponding patches or funding places an unfair burden on volunteer maintainers. The conversation also covers Microsoft Teams posting high-priority bug requests on volunteer trackers, and how social media 'spicy' posts have actually driven positive outcomes including increased donations and corporate accountability.
Summary
The conversation centers on a public dispute between the FFmpeg open source project and Google's security team, sparked by Google using AI to generate security vulnerability reports against FFmpeg. The core complaint is that Google deployed substantial compute resources and expensive security researchers to discover bugs, then announced their AI's capabilities publicly before the issues were fixed, while giving only a standard 90-day industry deadline without accounting for the volunteer-driven nature of FFmpeg's development. One flagged vulnerability was in an obscure 1990s game codec, yet was treated with the same urgency as a critical infrastructure flaw.
The speakers critique a broader cultural problem in the security industry: an incentive structure that rewards discovery and publicity over remediation. A quote from former FFmpeg developer Alex Strange on Hacker News humorously illustrates the asymmetry — security researchers get bounties, conference prizes, CVE logos, and media attention, while the volunteer who quietly fixes the bug gets nothing. The speakers argue this leads to 'alarm fatigue,' where everything is labeled high-severity, including a bug that would merely render one pixel the wrong color, making it harder for developers to triage what actually matters.
A separate incident involving Microsoft Teams is highlighted: a Microsoft Teams manager posted on FFmpeg's public bug tracker labeling an issue 'high priority' and name-dropping their product's visibility, apparently unaware that FFmpeg is maintained by unpaid volunteers. When offered a support contract, Microsoft countered with a one-time payment of a few thousand dollars, which the FFmpeg team called unacceptable. The speakers note this reflects a systemic failure in how large corporations internally communicate about open source dependencies, often bypassing or ignoring their own Open Source Program Offices.
Despite the friction, the speakers frame the Twitter drama as net positive: donations to FFmpeg increased, awareness of the project's volunteer nature grew substantially, and Google began sending actual patches and offering rewards for fixing issues following the public pressure. The value of 'spicy' social media posts is defended as the only real leverage small open source projects have against trillion-dollar corporations. Examples from VideoLAN (VLC) are also shared, where threatening to pull apps from the Android Play Store and Windows Store was the only way to get responses from Google and Microsoft respectively.
The conversation closes by celebrating young contributors to FFmpeg, including a 16-year-old named Ruka Peng who found and fixed a security issue quietly in three days without filing a dramatic CVE report, contrasting this with the security community's tendency toward public spectacle. The overall tone is that open source volunteer projects deserve more financial support, more respectful engagement, and recognition that they are not corporate vendors with SLAs.
Key Insights
- Google used AI at scale to generate security bug reports for FFmpeg, announced their AI's effectiveness to the media before fixes were in place, and applied a standard 90-day industry deadline without accounting for the volunteer-driven nature of the project — all while contributing neither patches nor meaningful funding.
- Alex Strange argued on Hacker News that security researchers are 'rampant self-promoters' who get bounties, conference prizes, CVE logos and media coverage for finding bugs, while the volunteer who actually fixes the issue receives nothing — illustrating a fundamental incentive misalignment between discovery and remediation.
- A Microsoft Teams manager posted on FFmpeg's public volunteer bug tracker labeling their issue 'high priority' and name-dropping the product's scale; when FFmpeg requested a support contract, Microsoft offered only a one-time payment of a few thousand dollars, which the team called unacceptable.
- The security community's habit of marking nearly everything as high severity — including a bug that would cause one pixel to render the wrong color, rated 7.5 in red — is likened to 'crying wolf,' which ultimately causes developers to stop taking warnings seriously, analogous to putting password stickers on a PC.
- A 16-year-old contributor named Ruka Peng found and fixed a security issue in FFmpeg within three days entirely through a git commit, with no CVE filing or public drama — held up as a direct contrast to the security industry's tendency toward alarmist public disclosure for issues that weren't even in a release build.
Topics
Full transcript available for MurmurCast members
Sign Up to Access