> The assumption being that nobody else knows about the flaws? Not nobody, but fewer. The information in a disclosure like this will focus a whole lot of miscr

> The assumption being that nobody else knows about the flaws? Not nobody, but fewer. The information in a disclosure like this will focus a whole lot of miscreants' attention on something they might not have thought of before. > that may greatly reduce the incentive of someone looking to do the investigative legwork Now you're the one making assumptions. Most people don't need the incentive of an immediate crisis to do that legwork. Often, the mere fact that the bugs are real is enough, regardless of timelines. In most other cases, the fact that the clock is ticking is sufficient. If somebody has a proven track record of taking these things lightly then forcing their hand might be justified. Otherwise, you're essentially telling people you think they're lazy or negligent when you have no evidence of such. That's not a good way to start a collaborative process, in a situation where collaboration might be key to a timely fix.