Let's take that avenue as a thought experiment... 1. Netgear buys the bug. 2. They keep shipping firmware with a private key. 3. Someone with malicious inten

Let's take that avenue as a thought experiment... 1. Netgear buys the bug. 2. They keep shipping firmware with a private key. 3. Someone with malicious intent finds it. 4. Someone with malicious intent MITMs a Netgear network and does something bad. 5. Bad actor sells bug online. 6. Millions of Netgear devices continue operating with compromised certs. Instead, here's what happened/happens now... 1. Researcher tries to coordinate with the vendor, realizes NDAs are involved and the vendor intends to keep shipping their private key. 2. Researcher dumps details of private key on GH instead. 3. Mozilla and Google stop trusting the cert. 4. Now Netgear no longer gets to decide if they want to fix the problem. Browser vendors have fixed it for them. 5. Millions of otherwise insecure Netgear devices are protected by the browser instead. 6. Netgear rightfully gets bad press and hopefully the shaming makes them rethink their positions on NDAs in their bug-bounty program. 7. Future bug hunters submit bugs straight to a receptive Netgear, who has learned a valuable lesson about being a lazy hack.