Full disclosure is shifting responsibility away from developers, and onto "security" companies and end users. Why not look at it this way: Companies don't have

Full disclosure is shifting responsibility away from developers, and onto "security" companies and end users. Why not look at it this way: Companies don't have a financial motivation to spend extra engineering man-hours on security in the absence of full-disclosure. I think the problem here is that security researchers (and hackers concerned about security in general) believe that security should be a concern of software companies, but they don't realize the prisoner's dilemma that software companies find themselves in. If I run a software company and I spend extra man-hours on security, but my competitor doesn't, and they beat me to market, what do I gain? Will I have enough cash on hand to survive the 2 years it might take for a crippling exploit of their code to arrive and finally give me the market advantage? In a perfect world all code would be security reviewed, all the hungry children in Africa would have plenty of food to eat, there would be no wars, and John Lennon would still be alive to sing about it all... go figure.