In reply to Ian Dunn.

Thanks. I appreciate the apology.

But, again, you misunderstand me. I'm not taking a philosophical position for or against full disclosure as a matter of principle. In fact, I can think of at least two situations when I'd support it (when an organization has shown, by its previous conduct, that giving it more time doesn't work; and when an organization is trading on claims of security to make money when in fact its security is full of holes).

I'm just criticizing Ms. Zhu in this particular circumstance. The good thing is that she (and probably others) might now give themselves (and not just those to whom they have reported a security issue) a bit longer to think about what they should do rather than just assuming that after 24 hours it's OK to broadcast the issue far and wide.