Should developers be sued for security holes?