Good points. I also think that PR departments would cry out loud if the bugs in publicly founded software were too easy to find. The believe in security by obsc

Good points. I also think that PR departments would cry out loud if the bugs in publicly founded software were too easy to find. The believe in security by obscurity is just too strong there... Their mindset usually is: "better keep it hidden, even if we leak citizens private informations all over the internet." "and at least our funding won't be removed because some shitty paper stumbles on those leaks and makes a big deal about it".