> "The fact is that the devs certainly do know about it by now, yet users do not have a fix yet." Citation needed. > "It is best for users to know that their

> "The fact is that the devs certainly do know about it by now, yet users do not have a fix yet." Citation needed. > "It is best for users to know that their system is vulnerable, and how to fix that without waiting for a system update." Stepping outside the 'tech' social bubble, most general users likely won't create a root account and password from something they see on TV or their local news site or at least not before a patch would have been released. -- Further to previously provided examples: https://www.cloudflare.com/disclosure/ https://www.cloudflare.com/disclosure/ https://access.redhat.com/security/team/contact https://access.redhat.com/security/team/contact https://www.xenproject.org/security-policy.html https://www.xenproject.org/security-policy.html https://about.gitlab.com/disclosure/ https://about.gitlab.com/disclosure/ https://help.github.com/articles/responsible-disclosure-of-security-vulnerabilities/ https://help.github.com/articles/responsible-disclosure-of-s... https://www.kernel.org/doc/html/v4.10/admin-guide/security-bugs.html#contact https://www.kernel.org/doc/html/v4.10/admin-guide/security-b... https://www.drupal.org/drupal-security-team/general-information https://www.drupal.org/drupal-security-team/general-informat... https://www.cisco.com/c/en/us/about/security-center/security-vulnerability-policy.html https://www.cisco.com/c/en/us/about/security-center/security... https://www.juniper.net/us/en/security/report-vulnerability/ https://www.juniper.net/us/en/security/report-vulnerability/