Home Music and Digital Media Ars Technica Researchers wait 12 months to report vulnerability with 9.8 out of 10 severity rating