I mean, no, but you can't actually account for the worst security results. Heartbleed is still unpatched in a lot of places, but there's really no disclosure s

I mean, no, but you can't actually account for the worst security results. Heartbleed is still unpatched in a lot of places, but there's really no disclosure strategy capable of improving that. Even a low-skilled maintenance team can be on heightened lookout for compromised accounts and illicit connections. I'm not sure I back Google here, though. Generally, I think active exploits are reasonable to disclose, but Microsoft had a specific patching plan that would have been up in another week. It seems reasonable to accommodate requests like that when the vulnerable product is actively being fixed.