> I think a better solution would be to legally protect anyone that's honestly reporting a vulnerability; make companies liable for those vulnerabilities; offer

> I think a better solution would be to legally protect anyone that's honestly reporting a vulnerability; make companies liable for those vulnerabilities; offer a failsafe reporting mechanism to the government in place of the company, in case they just ignore it; and guarantee that reporting a vulnerability can't ever be used against you in any kind of criminal or civil trial. This would also very useful for more generalised whistle-blowing too..