I'm sure 'tptacek is tired of grinding this particular axe so I'll trot out the usual arguments: - Discovery didn't create the bug. You have no idea who has be

I'm sure 'tptacek is tired of grinding this particular axe so I'll trot out the usual arguments: - Discovery didn't create the bug. You have no idea who has been exploiting the shit out of it already. - Vendors will have all sorts of unreasonable responses, from ignoring you to threatening legal action to dragging their feet. - Vulns are work product. You are entitled to zero of the researcher's time and effort unless you're paying them for it. I'm not saying coordinated disclosure is bad either! I prefer to do it when I find stuff. We found a bug in NextJS last week and we did coordinated disclosure (I'm talking about it now because they released a fix). I'm saying the researcher owns the bug. EDIT: Oh no! Of course he beat me to it.