Graceful Disclosure: The Pros and Cons of Mandatory Reporting of Security Vulnerabilities