An upstart security research firm with a controversial business model is at the center of a debate over how software bugs should be disclosed. Vulnerability Discovery and Analysis (VDA) Labs, founded ...