In the past they apparently spent more time finding such holes themselves, but no longer find that as necessary. "The bad guys are not the ones actively finding vulnerabilities — they've shifted their business to standing on the shoulders of the security research community ... They don't have to do the hard work anymore. Their job is packaging what's been provided to them." The second trend is that the debate among security researchers is intensifying over how much information should be released to the public when a new software flaw is discovered. Full Article at USA Today