Vulnerabilities: keep them secret as a weapon against the bad guys or tell the world so we can all get patched?