In reply to Ian Dunn.

So I've read http://googleonlinesecurity.blogspot.com/2010/07/rebooting-responsible-disclosure-focus.html and https://www.schneier.com/essay-146.html and both articles have really opened my eyes. I find myself conflicted on which method of disclosure I support more. Schneier made some excellent points I never considered.

It seems as though I've made an error in judgement regarding Yan Zhu's actions but I can't make heads or tails of which type of disclosure is a win win situation for everyone involved. There is even this proposal of partial disclosure worth considering http://planetzuda.com/2014/03/28/partial-disclosure-proposal-to-replace-proper-disclosure-in-infosec/