Full disclosure of found software vulnerabilities and mandating that companies provide access to source code are two entirely different things. One component o

Full disclosure of found software vulnerabilities and mandating that companies provide access to source code are two entirely different things. One component of Schneier's recommendation is protecting researchers who practice full disclosure ("...attempt to muzzle security researchers who find problems"), but that's not really the core of his message in this post.