> Notifying impacted sites ahead of public disclosure would have been a better move Notifying that many effected websites is practically the same as making it

> Notifying impacted sites ahead of public disclosure would have been a better move Notifying that many effected websites is practically the same as making it public, and could've resulted in letting attackers know about this before the public (and any effected websites that aren't on your list) knows about it and is able to fix that.