The security community has a long history of releasing flaws publicly. Take this recent libc gettimeofday() exploit, for example. I administer some servers and

The security community has a long history of releasing flaws publicly. Take this recent libc gettimeofday() exploit, for example. I administer some servers and I am glad that I was alerted to the problem so I could address it. If that information had been hidden, then the problem would not have been fixed and eventually some black hat would exploit it. Publishing security flaws can cause problems in the short term but it's in everyone's best interests in the long term. It is vital that our infrastructure is protected against attacks and we can't afford to allow companies to sell and operate insecure industrial systems. Making this information public is the best way we have to get these problems fixed.