Seems unethical for people benefiting from something to externalize the cost of security, expecting bug hunters to work with no benefits. I could lean toward se

Seems unethical for people benefiting from something to externalize the cost of security, expecting bug hunters to work with no benefits. I could lean toward selling security fixes if it was commercial software. Not sure about free/open yet. If something like Tor, I'd rather we make exceptions regardless of general philosophy just to keep majority of people safe. Especially the kind of folks that help us out with their sacrifices. Most software isn't like that. My current preference is going back to highly-permissive, shared-source licenses by public-benefit companies whose charters and contracts don't let them screw people in at least all the ways we know about. Perpetual, free licenses w/ no or optional support for non-commercial or small business. Cost goes up with scale from there maybe with enterprise features sold separately. Anything not a competitive advantage, esp building blocks or platform stuff, might get open-sourced. Anyone licensed can modify the software and distribute that to other licensees. Might make exception for features or code in new version so they can't skip payment with backport. Maintains most of benefits of OSS with less risk of proprietary or hybrid licensing. Charging for security fixes could be a simple way of motivating folks to pay for improvements to the software. A preferred model that's harder to build is using methods that make nearly vulnerability-free software with a warranty against specific types of defects or at specific, defect rates. Cleanroom shops and Praxis Correct-by-Construction did that with an upfront premium applied with defect rate in warranty fixed at supplier's cost. So, still thinking on specifics of all of that or potential integrations.