[Dobbs]

You don't have to say you are studying the security implications, you could be say you are studying something else like turn around time for patches, or level of critique, or any number of things.

[colechristensen]

Yes you do. In no circumstances is it ethical to do penetrating tests without approval.

[joshuamorton]

In the thread you're in, the assumption is that the patches are never actually submitted.