so what? we should never disclose anything? this will only result in companies suppressing disclosure and leaving vulnerabilities unpatched.