> If googles approach is to force people fix them, so be it. That's not actually what responsible disclosure is for. Responsible disclosure is a process that [

> If googles approach is to force people fix them, so be it. That's not actually what responsible disclosure is for. Responsible disclosure is a process that [correctly] assumes that a malicious third party has also discovered the bug and is currently exploiting it or selling it, but acknowledges the assumption. If you disclosed bugs immediately, the could be novel and you could have let the cat out of the bag. If you never disclose bugs, they could already be in the wild and doing damage. Forcing Microsoft to fix it is just a beneficial side-effect.