>The basic problem here is very simple: found- and- fixed vulnerabilities aren't breaches. What makes this less than simple is that we may not know whether or

>The basic problem here is very simple: found- and- fixed vulnerabilities aren't breaches. What makes this less than simple is that we may not know whether or not a particular vulnerability was exploited (i.e if a breach has occurred). My opinion is that the likelihood of an undiscovered breach and the potential damage of any such breach should be taken into account when deciding whether or not to disclose a particular vulnerability. >The incentive problem isn't eliminated just because you only target Google with the new norm. I have no interest in targeting Google specifically (I'm actually a shareholder). They just happen to be big and have a lot of personal data. They are in the crosshairs of regulators and politicians as well, which is another reason to err on the side of transparency. I'm also not trying to eliminate the incentive problem by limiting it to Google (or other big companies). On the contrary, my opinion is that disclosing vulnerabilities in a timely fashion should be seen as building trust and become the new normal. Making it the new normal is what should fix the incentive problem over time as people get used to it. People tuning out is not a bad thing. The difference between an actual breach and a fixed vulnerability will not be lost just because vulnerabilities are no longer kept secret. But as I said, I don't think end-users should be notified of every single vulnerability.