Nicholas Carlini writes "Why I attack": from patchable vulnerabilities to unpatchable vulnerabilities

Google researcher Nicholas Carlini responded to criticism from University of Chicago computer science professor Ben Zhao on a public Discord server with 15,000 members, explaining his reasons for writing attack papers—driven by an interest in puzzle-solving rather than altruism. He categorizes all security vulnerabilities along a spectrum: at one end are patchable vulnerabilities, such as SQL injection or XSS against web servers, where developers should be given time to fix before disclosure; at the other end are unpatchable vulnerabilities, where he cites cracking AES or RSA as examples, noting that once such problems exist, the damage cannot truly be undone and should be disclosed immediately.