Disclosing vs. Hoarding Vulnerabilities

Bruce Schneier: "Should U.S. Hackers Fix Cybersecurity Holes or Exploit Them?"

He makes an interesting argument that the answer depends on how commonplace they are, and how they are distributed in software.