In reply to Jeff Chandler.

A proponent of full disclosure would argue that it matters because it if it's obvious to us, it's also obvious to attackers, which means that they're actively exploiting it. That's a key component of the argument for full disclosure: a vulnerability exists if it exists; keeping it secret doesn't change that. Keeping it secret isn't even really keeping it secret, it's just keeping it secret from users, because attackers *will* discover it on their own.

In light of that, keeping it secret could actually help the attackers, because the users can't do anything to protect themselves, and the company isn't under any pressure to fix it, so it remains available for an extended period of time.

Advocates of full disclosure argue that disclosing the vulnerability publicly is the best way to help users, because it forces the company to make fixing the hole a top priority.

Again, I'm not trying to convince anyone that full disclosure was the correct approach in this situation, but I do think you have to recognize that it's a valid argument made by well-respected experts in the industry, and that advocates of it are sincerely trying to protect users.

You asked who gets to decide... I could turn that around and ask you the same question. Who gets to decide that something isn't already known by attackers, or that users don't have the right to know that they're vulnerable? It's a complicated issue and researchers have to make a tough judgement call.

It's awesome that you're encouraging people to be more thoughtful and careful about how they disclose vulnerabilities, but I think the article criticized her position without accurately representing it. It didn't mention her reasons for disclosing it the way she did, or the complicated nature of the debate, so it came across as just tearing down a straw-man, and I think that gives readers who aren't already familiar with the other side of the debate a false impression.