You're forgetting the biggest factor: immediate disclosure also informs malicious parties. What's really more dangerous, an extra week with a vulnerability tha

You're forgetting the biggest factor: immediate disclosure also informs malicious parties. What's really more dangerous, an extra week with a vulnerability that might be known, or two hours with a vulnerability everybody knows about? Who's really more likely to see that disclosure on your personal Twitter account, every single (potentially non-technical) user of software you aren't even related to, or a few black hats who know you like to hack and brag? Yes, it also makes companies look better, but in this case my anti-corporate agenda needs to take a back seat.