In reply to KTS915.

Not necessarily. I'm not trying to convince you that full disclosure was the correct choice in this situation. Maybe it was, maybe it wasn't; that's not the point I'm trying to make.

What I'm saying is that full disclosure is a commonly accepted practice among security researchers, and that Yan's actions were consistent with full disclosure. I think those two facts are irrefutable.

You don't have to like that full disclosure is a commonly accepted practice, but you can't deny that it is. You don't have to agree that Yan's actions were the correct ones, but you can't claim that they weren't consistent with full disclosure practices.

My point is that responsible disclosure is not the only valid philosophy; full disclosure is also a valid philosophy. Each has pros and cons, and each applies better to some situations than others. Both positions are advocated for by respected, intelligent authorities in the field, and people on both sides are following their convictions about how best to protect users.

You're more than welcome to disagree with her choices, but it is intellectually dishonest to frame her as some careless teenager recklessly endangering users for shits and giggles when she is actually an intelligent, thoughtful advocate for user's rights who honestly believes that she acted in the best interest of users.

I don't have a problem with anyone disagreeing with her conclusions, but don't attack her character or treat responsible disclosure as a sacred cow.