"Everyone uses the same software, so fixing us means fixing them, and leaving them vulnerable means leaving us vulnerable." As a third option, a country may de

"Everyone uses the same software, so fixing us means fixing them, and leaving them vulnerable means leaving us vulnerable." As a third option, a country may decide to just patch their devices, but not disclose the vulnerability. Protect themselves while leaving others vulnerable. When other parties find and exploit the vulnerability (and they will), the best case scenario is, "Darn, we can't exploit that anymore". The worst case scenario is that exploitation causes some major disaster (widespread power outage, loss of SCADA control, etc.) that impacts us all somehow and that could have been avoided. Broad, public disclosure and patching seems the best choice for everyone.