What we need is to destroy the idea that somehow vendors can expect others to do their security work for them. Full disclosure all the way, and put the pain wit

What we need is to destroy the idea that somehow vendors can expect others to do their security work for them. Full disclosure all the way, and put the pain with those who are the root cause: customers who don't want to pay what it costs to develop secure software, or what it costs to implement secure processes (i.e., airgapped infrastructure).