Shooting the messenger, seems to be a common practice when it comes to security issues. We only hear about those situations where someone has gotten nailed beca

Shooting the messenger, seems to be a common practice when it comes to security issues. We only hear about those situations where someone has gotten nailed because they reported an issue but the fact that it happens at all is a problem. I think part of the problem is that fixing a security issue is expensive and usually involves company management that has very little experience with code development so they think the person that reported the issue is a black hat hacker. It also makes life difficult for everyone involved. A solution is to have a neutral in-between organization that can better understand how to deal with the problem without having to blame the person that reported it.