A single bad actor trying to find a bug in order to achieve a specific aim, might mean that bug is never known by the software creator. However the majority of the public is also likely to not know about the bug.
Public hunting and exposure via security advisories, it's going to lead to a greater awareness of vulnerabilities which I imagine will increase the likelihood of a particular vulnerability being exploited.
The time and effort required to fix a vulnerability is often substantial.
Perhaps we shouldn't be categorical, in our assessment of the merit in finding vulnerabilities in software?
The problem is economic. This necessitates constant effort to just keep software working, and that means the client needs to pay for that. And there's effort after effort after effort to force the software provider to pay for that.
Can bug finding lead to harm?
A single bad actor trying to find a bug in order to achieve a specific aim, might mean that bug is never known by the software creator. However the majority of the public is also likely to not know about the bug.
Public hunting and exposure via security advisories, it's going to lead to a greater awareness of vulnerabilities which I imagine will increase the likelihood of a particular vulnerability being exploited.
The time and effort required to fix a vulnerability is often substantial.
Perhaps we shouldn't be categorical, in our assessment of the merit in finding vulnerabilities in software?
The problem is economic. This necessitates constant effort to just keep software working, and that means the client needs to pay for that. And there's effort after effort after effort to force the software provider to pay for that.
https://www.ibanet.org/European-Product-Liability-Directive-...
Under these circumstances, of course, nobody has any incentive to find bugs, and everyone goes after people who find bugs.