Google found a vulnerability and reported it for free. Why do they need to do anything more? Give and inch and ffmpeg's twitter guy requests a mile. If you don't want people to use your software to make money, release it with a license that prohibits that.
> If you don't want people to use your software to make money, release it with a license that prohibits that.
Or, y'know, the project could balk at a trillion dollar company expecting them to do free work.
Cuts both ways.