> Standard practice is to inform the vendor early and work with them as you write the article This isn’t even remotely standard practice. A fair number of peo

> Standard practice is to inform the vendor early and work with them as you write the article This isn’t even remotely standard practice. A fair number of people and companies will give the vendor a chance by doing coordinated disclosures this way - but it’s in no way standard practice. Also when a company has a history of being openly hostile to disclosure attempts and downplaying stuff, the only way to force improvement tends to be “short warning, or even full disclosure”. I’ve done everything from coordinated to “no warning” disclosures in my career, and at this point I tend to lean more towards “no warning” in situations where a vendor has a history of dismissing concerns or openly being hostile to external researchers.