Eric Rescorla, “Is finding security holes a good idea?,” Workshop on Economics and Information Security, May 2004