They've been very effective at getting many large companies to actually fix security bugs, and release updates with those fixes in an actually reasonable time f

They've been very effective at getting many large companies to actually fix security bugs, and release updates with those fixes in an actually reasonable time frame. They've been very strict about their "we will publish the details of this security bug in 90 days unless you can provide a very good reason not to".