If the fix is implemented, wait a reasonable amount of time, then post the vulnerability to the Full Disclosure mailing list. If they feel that they don't have

If the fix is implemented, wait a reasonable amount of time, then post the vulnerability to the Full Disclosure mailing list. If they feel that they don't have to advertise the security fix, it becomes your privilege to decide how it gets advertised.