“Honestly speaking, we knew the software had that security flaw six months before launch. But the board said delaying would miss the holiday shopping window, so we shipped it and planned to call the inevitable patch a 'feature update.'”