The talk I'm giving is on a short paper I co-authored about strategic reasons not to patch and/or disclose security vulnerabilities.