Agreed. Troy's the-work-is-already-done argument is also (a) not logically sound even if it were true, and (b) not really true in the general case. Here's why

Agreed. Troy's the-work-is-already-done argument is also (a) not logically sound even if it were true, and (b) not really true in the general case. Here's why—first, though, let's highlight a just-so argument from the post: > Attempting to scare people with an alleged vulnerability then withholding information about it until a financial commitment is made all whilst claiming to be a "white hat" is dishonest, deceptive, and fraudulent. "Withholding information" in this context really means the absence of extra work—of having reached a milestone where something of substance is known, and a problem arises that involves needing to make a decision about whether to pursue it to its ends or not. Writing up a disclosure is something that takes work. Cleaning up a messy POC so that it can actually be understood by someone else (or just capturing one in a fixed form instead of something transient/ephemeral to begin with) is something that takes work. Being responsive to the other party's questions is something that takes work. Clearing time to make yourself available—even if the other party doesn't have any questions—is something that takes work. When you are claiming that someone has "already" done "the work" when they notify you a problem exists, you forfeit the argument the moment you ask "What is it?"