who benefits when researchers publicly posts information about vulnerabilities in an attacker's infrastructure or tools?

a typical argument defending this practice can be boiled down to the following: "im sharing information with other defenders that may not be aware of how to defend against this actor or tool"

this argument overlooks the fact that posting this information publicly also helps the adversary. Attackers will likely patch vulns in their tools/infra and/or refine their tradecraft to limit mistakes. to quote my colleague @bkmsft "the adversary also has ears"

when the adversary improves, defenders lose.

sharing information with other defenders is vitally important, but we, as a community, have a responsibility to do this in a way that doesn't benefit the adversary.

If Twitter was around during World War II do you think Alan Turing would have been posting about techniques to crack the Enigma?