The philosophy of responsible disclosure is something only pushed by security vendors, people who use open-source software (it's being a good member of a commun

The philosophy of responsible disclosure is something only pushed by security vendors, people who use open-source software (it's being a good member of a community) and brainwashed white-hats. The security professionals who do this for a living, and study this should disclose fully, but a corporate entity will never. They cannot because of shareholders, and there are way to many bugs out there and it would be embarrassing cleaning up that much crap. Security vulnerabilities are sometimes architectural problems, some are related to ignorance, but a LOT more are just stupid bugs and people not writing code that is correct. A good attacker doesn't care how they get in, there is always a way. It's a losing battle, just ask EWD. http://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340.html http://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340.... \\ Edit: Words are tough.