And if it's bad, if it's an attack tool or an exploit, it shouldn't be released. But Scambray disagreed. Scambray advocates trying to educate everyone about how computers work. If you restrict the flow of information, simply notifying people of a problem and patch, people have no way to authenticate the problem. Someone could say 'I found a flaw, here's the fix,' and take people to a bogus place, maybe just to get Microsoft's stock down a half-point briefly and make money.
Intent is also a consideration.
Mudge compared software that could be used to break into a system with lock picks. With L0phtCrack, if you just have it, fine. But if you're busted with 50,000 passwords, that's an additional charge. Fighting fire with fire More important to Mudge, though, was getting large companies to learn more about their systems before they're broken into. You need to create a war college.