It's interesting how the security "research" community is happy to write the most ruthless things when they find security flaws. But get upset when called out about sending patches to volunteer projects like FFmpeg (or libxml2)