The other way would be that writers check for correctness of what they're writing with the impacted party (VLC). Distributions watch out and look for security h

The other way would be that writers check for correctness of what they're writing with the impacted party (VLC). Distributions watch out and look for security holes in their packages such as libebml and then issues fixes as soon as possible. Security bug reporters behave more responsibly in that they talk authors of the package first, then go cash in their piece of fame.