[twhb]

You're forgetting the biggest factor: immediate disclosure also informs malicious parties.

What's really more dangerous, an extra week with a vulnerability that might be known, or two hours with a vulnerability everybody knows about?

Who's really more likely to see that disclosure on your personal Twitter account, every single (potentially non-technical) user of software you aren't even related to, or a few black hats who know you like to hack and brag?

Yes, it also makes companies look better, but in this case my anti-corporate agenda needs to take a back seat.

[tokenizerrr]

Knowing a vulnerability exists is useless without a clue what direction to search. Read the tweets again.