On exploits, hubris, and software security

[BlueBoar at thievco.com (Blue Boar)]

Gary McGraw wrote:
> The main thing I wonder is, what do you think?  When you have a hot
> demonstration of an exploit, how do you responsibly release it?  What
> role do such demonstrations play in moving software security forward?

To pick one extreme, I believe there are times when intentionally 
blindsiding a vendor is appropriate:
http://ryanlrussell.blogspot.com/2006/11/you-want-mac-wireless-bugs.html

                                        BB