Alessandro Riolo
I never understood why you guys don’t ask good money from these people. Literally, send them a quote and a contract to sign as an answer. The quote must be something $1,000 per hour for a minimum spend of say 20 hours for the impact assessment, with the rest of the retainer to be
ffmpeg
Arguably the most brilliant engineer in FFmpeg left because of this. He reverse engineered dozens of codecs by hand as a volunteer. Then security "researchers" and corporate employees came along repeatedly insisted "critical" security issues were fixed immediately waving their CVEs. This was hugely demotivating to the fun and enjoyment of reverse engineering.