Arguments about what really is "responsible" disclosure. Web security researchers being dragged off in handcuffs for "knocks on the door," while software security researchers gleefully post proof-of-concept exploits publicly. Vulnerability researchers rallying to the cry of "no more free bugs," while software vendors waffle between "sure, we'll pay you," "no, but we'll send you a nice thank-you," and "that's extortion."