Vulnerability Reporting is Dysfunctional