> Some researchers do want to make a name for themselves and publish before the patch, but those are minority. And publicly attacking a big corporation is quite

> Some researchers do want to make a name for themselves and publish before the patch, but those are minority. And publicly attacking a big corporation is quite risky so they prefer presenting the bug as general problem in the technology. That doesn't sound right to me. The industry norm for security research is 'responsible disclosure', which is intended to give the vendor reasonable time to implement the fix, while eventually publishing the knowledge for all to know. Unless they're simply being paid for their silence, I can't imagine a security researcher wanting to keep quiet about a major achievement like that. > bugs in hypervisors exist, see CVE's for Xen for the past decade Sure, but I'm talking specifically about the big 3 cloud providers, not vanilla Xen. Amazon in particular have gone to pretty extreme lengths with their Nitro system.