When vulnerability information is disclosed without a patch available, users are the ones really being punished.