> There's room to debate how long you have to wait before disclosing an unpatched vulnerability to the public, but I think we should all agree it's longer than

> There's room to debate how long you have to wait before disclosing an unpatched vulnerability to the public, but I think we should all agree it's longer than that. I'm fond of immediately, myself. I don't see the point in letting bad agents (many corporations, a variety of seedy open source projects) off the hook. As a consumer of software, I want to know, immediately, when there is a problem. For a variety of systems, I can control the architecture and code myself to mitigate it ASAP.