The upside is a certainty - giving a heads up to people we know are getting hacked, and whose repercussions for getting hacked could mean imprisonment or death.

The upside is a certainty - giving a heads up to people we know are getting hacked, and whose repercussions for getting hacked could mean imprisonment or death. The downside is allowing other hackers to maybe produce an exploit in time (before this bug gets patched), and maybe hack some more people. I'd say the upsides outweigh the downsides.