> yet (most) people did the right thing and disclosed their finds responsibly. How would you know? I'm not a security researcher and still know that there were

> yet (most) people did the right thing and disclosed their finds responsibly. How would you know? I'm not a security researcher and still know that there were always multiple avenues for selling vulns, and most weren't public. So really, what makes you think you can make that statement with any kind of confidence?