> vendors need to deal with bad code and products in realtime One of the main reasons for coordinated disclosure is that, over time, it has become evident that

> vendors need to deal with bad code and products in realtime One of the main reasons for coordinated disclosure is that, over time, it has become evident that vendors will not do that. We can say it until we're blue in the face, but vendor behavior will remain largely unchanged regardless (there are a few bright spots, but not nearly enough). So you go to war with the army you have. In this case, that means frequently deferring/coordinating security event communications. As much as I wish the market would appropriately penalize vendors that encourage researchers to sit on 0-days, that rarely happens, and the cost of insecurity is passed onto consumers instead. Tl;dr delaying disclosure does suck, but you should still do it.