> Criminal researchers might have found this information anyway, it's only fair to put the customers on an equal footing. Or they might not have, in which case

> Criminal researchers might have found this information anyway, it's only fair to put the customers on an equal footing. Or they might not have, in which case you just gave them a pretty powerful weapon, and it's pretty unfair to customers?? > It's disclosed so that the customers know what the vulnerability is. Sometimes patching is not the best thing to do for a given situation. Other mitigations might be possible, or it might not even be an issue depending on how the software is used. Are you sure "because maybe you shouldn't the patch" is their logic here? (Which doesn't even necessitate this either, but everything I've seen indicates they want you to patch immediately.)