Disclosing vulnerabilities to improve software security is good for everyone