Decades of experience shows that revealing security problems leads to greater overall security than not doing so. Coordinated disclosure is to mitigate the eff

Decades of experience shows that revealing security problems leads to greater overall security than not doing so. Coordinated disclosure is to mitigate the effects of a particular case - but vendors routinely abuse it to sit on problems for months or even years (in their own interests), leading to a movement for full disclosure (in their customers' interests). Also, you seem to be assuming the bad guys don't know already. (This is why Microsoft's complaints about Google revealing their holes don't convince me: we already know Windows is peppered with holes that are unknown to the public but are literally commodities to criminals and national security organisations. Revealing all of them would increase our security and not decrease it even in the short term.)