Security people like to paint this as a binary choice, then inevitably siding with "disclose immediately". But it's not really is it? Why do we put locks on o

Security people like to paint this as a binary choice, then inevitably siding with "disclose immediately". But it's not really is it? Why do we put locks on our doors? It's not so that career hardened cat burglars can't get in - it's to prevent crimes of opportunity and small time crooks from getting an easy target. I feel like there's an analog with software. Quietly commit fixes for the RCEs to DNSMasq. Those who care will stay on the latest version. You can even say "Fixes security issues" in the release notes. But, wait awhile to release the PoCs and detail the exploits completely. The nation states will find a way to exploit it no matter what, of course. But you average cybercriminal will have a much harder time without PoCs clearly showing the attack vector.