Sounds great, but doesn't really work with open source software (unless I have some wires crossed). Who is supposed to pay for an exploit in (say) MariaDb? The

Sounds great, but doesn't really work with open source software (unless I have some wires crossed). Who is supposed to pay for an exploit in (say) MariaDb? The value to a sufficiently motivated black-hat organisation is surely far higher than the value to any one user of MariaDb, no matter how big they are.