I dunno, I feel like "the only thing that can stop a bad guy with a buffer overflow is a good guy with a buffer overflow" makes even less sense than the origina

I dunno, I feel like "the only thing that can stop a bad guy with a buffer overflow is a good guy with a buffer overflow" makes even less sense than the original form of that. Secure systems that do what they say they'll do help everyone. The idea that there's some sort of obligation to keep security vulnerabilities around so that the bad guys can get pwned feels as vile as saying that there's an obligation to keep medical knowledge secret lest enemy soldiers learn how to take care of their health.