The "responsible" disclosure term is a pretty devious piece of marketing, because it creates situations such as this very thread. Its use carries an implicit c

The "responsible" disclosure term is a pretty devious piece of marketing, because it creates situations such as this very thread. Its use carries an implicit catch that anything that does not meet the narrow definitions of "responsible" is the opposite. Without naming names there are vendors that have been pretty terrible at handling their end of "responsible" disclosure and appear to be getting worse, down to not even acknowledging there is a problem or even that they have been notified of a problem. The alternative to disclosing a vulnerability is non-disclosure and, frankly, that's what some vendors mean when they say "responsible".