In reply to Mike Schinkel (@mikeschinkel).

Personally, I never felt like her responses were empty justifications, but that's admittedly pretty subjective, so there's probably no point in quibbling over it.

I think I came at the lack of acknowledgement from a different perspective, although I'm definitely sympathetic to your point of view. I was thinking that, from her perspective, the lack of any kind of response after 24 hours -- crossing all times zones, in the middle of the week, after the security contact form said that we'd respond within 24 hours -- could easily be mistakenly interpreted as a lack of interest, especially given the nature of the vulnerability (which one could reasonably assume was an intentional design decision, rather than an unfortunate combination of events, especially if one has been burned by companies in the past when trying to report similar issues).

But yeah, like I've hinted at before, I personally would have waited much longer than 24 hours, but I've been trying to put myself in her shoes, and when I do that I'm able to see a compelling case for why she made the decisions that she did.