Yeah that post makes a lot of sense. It seems like this would establish a norm of generally trying to coordinate with a vendor in many circumstances (if a web s

Yeah that post makes a lot of sense. It seems like this would establish a norm of generally trying to coordinate with a vendor in many circumstances (if a web service is vulnerable hard for users to fix it themselves after all). Might of misread what "norm" meant here