Many (but not all) researchers seek out vulnerabilities in an attempt to reduce risk. However, they ignore the threat component. And that means that, in order for risk to be reduced, any reduction in vulnerability level must be greater than the increase in the threat levels. Even though most vulnerabilities are never exploited, there are a number of examples from the past that show that more incidents occur after a disclosure event. Given the SCADA situation at hand, it is unlikely that the vulnerability level will be reduced to offset the increase in threat, and therefore more incidents are likely.

It is a very valid point. I agree with the full vulnerability disclosures, however you also need to take into account whether disclosing it without control will affect the safety of people, the security of systems beyond the software vulnerable and the overall picture.

Go read the entire post. Some very valid points.