The Engineers Who Said No
[I loved this interview that
@lexfridman did with
@jean_kempf48856 and
@kierank_ . Tons of great nuggets for founders and operators. I'm enclosing an executive summary below]
Jean-Baptiste Kempf (President of VideoLAN, creator of VLC) and Kieran Kunhya (FFmpeg developer), interviewed by Lex Fridman (Lex Fridman Podcast #496, May 6, 2026)
Summary: Two of the people who built the open source video stack that runs Netflix, YouTube, Chrome, OBS, Discord, and basically every video you have ever watched sit down to explain why they refused tens of millions of dollars to keep VLC clean, why "we don't care if you're a dog" is the most important rule in their community, and why public shaming on X is the only escalation channel volunteers have against trillion-dollar companies. The result is the strongest case yet that the internet's most critical infrastructure rests on a few dozen people whose primary skill is saying no.
1. The 5-Person Bottom Layer. Five core developers maintain VLC. Ten to fifteen maintain FFmpeg, which ships inside YouTube, Netflix, Chrome, Discord, OBS, and most smart TVs. Kempf puts the retention math plainly: a thousand contributors land patches over a project's lifetime, and ten stay. People change jobs, have children, get into accidents, drift away, and the runtime of civilization's video pipeline rests on whoever does not drift.
2. Maybe You're a Dog. The community has one rule for accepting contributions: is your code good. Kempf repeats it twice in the episode, almost verbatim: "Maybe you're a dog. I don't care." The patch is the only signal that counts. Teenagers have written more lines of assembly in FFmpeg than Google engineers, and the project shipped at that quality because the maintainers refused to let any other criterion in.
3. Saying No to the Toolbar. Kempf has turned down "dozens of millions of dollars" to keep VLC free of ads, several times. The offers came from spyware toolbars, search-engine hijacks, and in-app ad SDKs. The math was real: take the deal, get rich, and within three years someone forks VLC clean and the user trust collapses. His principle is about being able to live with himself: "I need to go to bed at night and be happy about what I've done."
4. The Clean Buyer Never Showed Up. Kempf is clear he would have taken a Netflix integration deal. The clean buyers never knocked. Every offer he received came from companies whose business model required burying the consent in license text nobody reads. The default state of being a popular free product is getting approached only by predators, and the founder's job is to recognize that pattern before the offer feels flattering.
5. The Nebraska Problem Has Names. XZ is maintained by one person. LibXML, the only library that parses XML at scale, is now unmaintained. Time zones for the entire industry run off one engineer. FFmpeg and VLC are, in Kempf's words, "not the worst" open source projects in this picture, which says everything about the rest.
6. AI Slop as Denial of Service. Google ran AI security scanners across FFmpeg, generated wordy high-severity reports on a 1990s game codec, handed the volunteers a standard 90-day disclosure deadline, and announced its AI's prowess to the press before the bugs were fixed. Kunhya's framing: bug discovery now has industrial-scale funding; bug fixing has none. The volume of reports has become a denial-of-service attack against the maintainers, executed by the same companies who use FFmpeg at millions-of-cores scale and contribute almost nothing back.
7. The Padlock Is Not Fort Knox. Kunhya's keeper analogy: a lock on a house is calibrated to what it protects, not to stop a nation state. Marking every integer overflow in a 1993 game codec as "high priority, scary, scary" trains the world to ignore the actual alarms when they fire. Severity inflation destroys the signal that severity is supposed to carry, and the security industry is now financially incentivized to keep crying wolf.
8. Spicy Tweets Are HR. VLC could not get a human at the Google Play Store to fix a year-old Android distribution bug. The only escalation that worked was tweeting that VLC was about to leave the Play Store and let 100 million Android users notice. The same maneuver worked on Microsoft. Kempf has no ISV rep, no Microsoft point of contact, no SLA, no inbox somebody answers; public shaming is the entire enterprise relations function of every project the internet depends on.
9. The OSPO Gap. A Microsoft Teams manager once filed a "high priority" bug on a public FFmpeg tracker, name-dropping Microsoft as if that obligated the volunteers, and offered "a few thousand dollars" for long-term support. He did not know what an Open Source Program Office was supposed to do, and his employer did not bother to tell him. The disconnect between procurement and engineering inside large companies is the rule, and open source maintainers eat that gap directly.
10. Excellence Because You Cannot Babysit Strangers. Linus Torvalds gets cited as the canonical harsh maintainer, but Kempf reframes the tone. Code review is brutal because the five people in the room are the ones who will own the patch forever after the contributor disappears. "We need excellence because we are very few to maintain something that is critical for the whole." Strictness in review is a survival policy when staffing is one percent of contributors.
11. Forks Are the Pressure Valve. The 2011 FFmpeg/Libav split looked like a community-destroying schism, then ended with FFmpeg absorbing Libav's best work and Libav fading. GCC went through the same thing with EGCS and came out stronger. The right to fork is the mechanism that lets governance disputes resolve without anyone holding the project hostage, which is why the open source license matters more than any feature roadmap.
12. Maintainer Burnout. The XZ supply-chain attack worked because the maintainer was harassed nonstop by the attackers until he handed over commit access just to be left alone. Kempf has received death threats in the mail, with white powder, for deprecating PowerPC support in VLC. The XZ playbook now sits in the open, AI is multiplying the volume of toxic interactions, and most companies that depend on open source still have no line item for hardening the humans who hold up the stack.