EFF questions US government’s software flaw disclosure policy