The quotes get munged so I’ll try this.

@Emilio wrote: Obviously there is no working security concept at wordpress.org

Uh huh. Right. Gotcha.

https://developer.wordpress.org/plugins/wordpress-org/plugin-security/reporting-plugin-security-issues/
https://wordpress.org/about/security/
https://hackerone.com/wordpress

@Emilio wrote: Current approach with “security by obscurity” by silently hiding vulnerable plugins so hackers won’t notice is a) irresponsible and b) completely wrong.

That’s not “security by obscurity” and your comment is why I wrote this.

Jan Dembowski wrote: It’s easy to say something is inadequate without proposing a working solution. It’s quick to comment about that and the indignation and righteous outrage sure is gratifying isn’t it?

I’m not trolling you or anyone but please try to make informed comments.

Dan Feidt (hongpong) wrote: But we cannot speak of “responsible disclosure” without addressing the fact that delisting plugins is not publicly conveyed to everyone.

I am not on the plugins team (I am a forum moderator) and I do not necessarily disagree with you. The de-listing of plugins is more often than not for other reasons having nothing to do with security. The current process is a compromise and it’s changing all the time to improve.

But again, this post isn’t about responsible disclosure. John’s actions are not about that at all. It’s a temper tantrum and when he posts this in the forums:

John Grillot in the forums: If you have a problem with this type of full disclosure please contact the leadership of WordPress and let them know that the moderation of this forum needs to be cleaned up, since that is how these full disclosures will end.

He’s really saying this:

John Grillot (translated) in the forums: I will keep shooting the hostages one at a time until my demands are met.

There’s no other rational way to read that. This is not a debate about how to disclose vulnerabilities in a responsible way. It’s a malicious disclosure in a blatant attempt to force people to permit his behavior that flat out is not allowed by anyone in the forums. The whole “moderation of this forum needs to be cleaned up” is just his gaslighting.

That is his intent and that matters. His statement isn’t “I fight for the users” it’s about getting air time and coverage.