> No, I'm suggesting that only testing on system shipping weak protection systems and poor defaults is misleading. But then he would not have found and reporte

> No, I'm suggesting that only testing on system shipping weak protection systems and poor defaults is misleading. But then he would not have found and reported the vulnerability, yet it would still exist and affect people. Once the vulnerability was discovered it doesn’t matter if one operating system or the other has protections in place that will stop it. What matters is that the code is vulnerable and that there are people who are not protected. Proving that it is not exploitable on systems configured a certain way does not invalidate the original finding.