Keep the deadline, make the finders fix it

Reasons

1. 1.

   Finding bugs has far outrun fixing them, so the bottleneck is the fixing, not the deadline.^[1]

   1. [1]Source 1: Atlantic Council: New AI models are pushing open-source security to its limits. Their developers must step up. · atlanticcouncil.org · Open original

   ConvincingObjectSupportSource ▾⋯
2. 2.

   A company that can find a bug with AI in minutes is also the one best placed to write and test the fix.

   Unsourced·Add a source

   ConvincingObjectSupportSource ▾⋯
3. 3.

   Trillion-dollar companies rely on volunteer code like FFmpeg, so dumping bug reports on its volunteers shifts their costs onto unpaid people.^[1]

   1. [1]Source 1: It’s FOSS: FFmpeg calls Google’s AI bug reports “CVE slop” · itsfoss.com · Open original

   ConvincingObjectSupportSource ▾⋯