DevSecConflict: How Google Project Zero and FFmpeg Went Viral For All the Wrong Reasons

Security research isn’t a stranger to controversy. The small community of dedicated niche security teams, independent researchers, and security vendors working on new products finds vulnerabilities in software and occasionally has permission to find and exploit them. This security industry has always had a fraught relationship with the law and the terms of service of the organisations they target, as notoriety is prioritized over legalities.