Security of a system is an intrinsic property that does not change upon scrutiny. Rather than accuse those not reporting the results of their researchers we should focus on building systems that are secure like seL4. This blame game is counterproductive and distracts from making secure systems.
Re:The NSA Is Hoarding Vulnerabilities
by anexprogrammer on Friday August 26, 2016 @09:49AM
(#12366184)
I'm not suggesting accusation of researchers, but in the case of NSA isn't part of their mission improving network security? They founded SELinux after all.
It's not like vulnerabilities are rare or aren't going to be exploited if not revealed.
I do not think that it is feasible to expect a government agency to solve bad engineering. There is no pixie dust that the NSA can sprinkle on systems to make them secure, even if it dedicated all of its resources to trying.
If anything, by doing what they are doing, they are exposing the fallacy of such expectations and hastening the development of systems that are actually secure. By that measure, this is actually improving security in the long term far more than attempting to bolster the status quo ever could.
Even with the most positive view, some small subset of those vulnerabilities will be known to others and some will be actively exploited. Hence making us less secure.