Do you have a link? I'd expect the incentives to be a bit more complicated than that, and I'm also a bit skeptical that either is all that good of a solution.

Do you have a link? I'd expect the incentives to be a bit more complicated than that, and I'm also a bit skeptical that either is all that good of a solution. I'd also like to see how exactly "proactive" and "reactive" are being used here, is it about push vs pull for vulnerability notifications, or about hiring their own security researchers, or... ?