I'd maybe disagree that there is "no security gain from tweeting about this". I think there is a security gain from warning people that an urgent security patch

I'd maybe disagree that there is "no security gain from tweeting about this". I think there is a security gain from warning people that an urgent security patch is on the way so they should prepare themselves/their organisation to deploy the patch as soon as it lands. Now you could argue that a personal twitter account is not the best medium for this warning (maybe it should come directly from Google Project Zero or Microsoft), but Tavis does have a large sphere of influence, and I invariably hear about these things through him than via other sources so it is an effective medium. Edit: Note, the argument here is whether his initial tweet (https://twitter.com/taviso/status/860679110728622080 https://twitter.com/taviso/status/860679110728622080) constitutes disclosure - I don't think it does. The actual disclosure was handled according to Google Project Zero's policies.