> The researcher here allowed 9 months for them to fix. The researcher is basically allowed to do whatever they want here. They can wait 0 days and just post

> The researcher here allowed 9 months for them to fix. The researcher is basically allowed to do whatever they want here. They can wait 0 days and just post to the full-disclosure mailing list. Or they could never disclose it. Personally, I've done both. I took DJB's "Unix Security Holes" class, where we had to find 10 vulnerabilities in OSS as the class's final project. All of those got 0-day disclosed because that is how DJB rolls. I've also independently found bugs, and I was satisfied by the resolution from emailing security@ that company.