I'm not sure timing matters, ever. Why should it? Large organizations will pay millions of dollars for canned 'assessments' that create far more noise and opera

I'm not sure timing matters, ever. Why should it? Large organizations will pay millions of dollars for canned 'assessments' that create far more noise and operational problems than reports like this - yet the knee here reaction to responsible disclosure is "well you didn't send it to us on the third Sunday of the month after a blue moon". Get a clue. If someone responsibly discloses then suck it up, fix it and when you don't expect to hit the front page of the local news. That's how reality works today, and as stated in the article, if this young researcher has found it it's either already known or the sands of time were close to running out on malicious use case. I believe that if an organization wants to incriminate responsible disclosure then they have to have a public ToS stating any disclosure is subject to just that. Then they will dissuade any free help in a public fashion and left to their own devices. In that case there should be non-retaliation protection available via the state to anonymously submit without fear of being penalized. If there was a big hole in the side of a bank and it was illegal to talk about it do you just accept it and move on? Do you continue to bank there? There's inherent risk with providing Internet based services. Deal with it instead of being ignorant about it.