The points stand on their own, and I think it's useful to have a phrase that markets the practice. I personally view it as irresponsible regardless of whether

The points stand on their own, and I think it's useful to have a phrase that markets the practice. I personally view it as irresponsible regardless of whether we called it "Foo Disclosure". I do view sharing the exploit on the patch date irresponsible irrespective of the term. I believe the name was chosen well, and I don't think it deserves painting with "PATRIOT ACT" type brush. I've dealt with commercial firms as well as non-commercial firm disclosures, and really working with people who report security issues could go a LOT smoother. A lot of those experiences did not go well, but it would be wrong for me to make generalizations. Business here on either side doesn't matter; the user is all that matters, and it shouldn't be about getting "credit", earning points, or being done with something quickly. I think a lot of people think this is a game or something, and it's really not. Real systems and real people's data are on the line.