If it was up to me, we&#x27;d come pretty close to banning the manufacture of firearms and ammunition, so I&#x27;m not the right person to ask about this. But, once again:<p>* Vulnerability researchers do not as a rule disclose to vendors. Some do, some don&#x27;t.<p>* Sponsoring the discovery of a vulnerability so you can write an exploit for it doesn&#x27;t prevent others from finding that vulnerability and patching it. If anything, sponsoring vulnerability discovery for exploit development <i>increases the likelihood that the bug will be patched</i>.<p>* When I ran a security consultancy, we had a &quot;no selling vulnerabilities&quot; rule. Published, on our website. I was comfortable with that, because &quot;my company my rules&quot;. I am a lot less comfortable dictating my own morals on other people  that don&#x27;t have a contractual agreement with me.<p>* It is difficult to come up with an argument that vendors should get disclosure of vulnerabilities that doesn&#x27;t involve vendors entitling themselves to the (often very expensive) work of vulnerability researchers. It&#x27;s especially galling to see companies that don&#x27;t spend any real money on software security expressing that sentiment.<p>And, of course: software vulnerabilities aren&#x27;t infectious disease agents. The revulsion we have for weaponizing infectious diseases comes from the concern that they will spread unchecked. But that&#x27;s not how software vulnerabilities work.