The vulnerability is what puts users at risk. The reporting reduces that risk. The fact that it wasn't 'responsibly disclosed' just means the risk wasn't reduced as much.

I HATE that these huge companies with massive budgets get so much free research and code review. They don't deserve it.

These 'researchers' put a lot of time and effort into finding vulnerabilities and (in my opinion) should NOT be required to notify the sloppy developer first.

Maybe if the developers knew they aren't going to get advance notice (for free, no less) they would be more careful in the first place.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/58/295#295