I’m not suggesting a delay. Responsible disclosure was the wrong term to use. The distinction I was trying to draw is rather than just blogging about it or unl

I’m not suggesting a delay. Responsible disclosure was the wrong term to use. The distinction I was trying to draw is rather than just blogging about it or unleashing a Twitter storm and jumping straight to an adversarial public crucifixion of the vendor (and by all means do that as well), there should be a standardised process of also contacting that vendor directly and engaging with them to give them an opportunity to fully understand what is being reported, reproduce the issue (in the case of it being unexpected) and fixing the problem. Some vendors won’t engage or will stick their head in the sand, but others may actually choose to address the problem. This is also in the users’ best interests. Some issues will hit Hacker News or gain visibility in other ways, but other issues that are published may not naturally reach the eyes of someone at a vendor unless the person publishing actually takes steps to contact them. That’s the point I was trying to get across. Not suggesting any of that is a prerequisite to publishing anything publicly in parallel.