So..
If they can decree that X vulnerability must be patched, does it mean they can also decree Y vulnerability may NOT be patched ?
There is a wide disconnect between the interests of those exercising power (as distinct from 'running the show'), and the general public.
Biting the hand that feeds IT
