In reply to Ian Dunn.

Nacin responded to this comment elsewhere, but 2 years is incorrect. He said (in reference to your comment on this blog):

1) The EFF staffer was not representing the EFF.

2) The issues reported publicly last week have essentially nothing to do with the blog post linked here.

3) The issues reported publicly last week have to do with custom WordPress.com functionality and configuration, and not WordPress core.

4) The full disclosure was well-intentioned. Unfortunately, nuance is a major role when discussing responsible disclosure. I have seen countless "full disclosure" reports that are wrong and invalid, or worse, that the reporter thought was "minor" but in reality is far more complex and deserved greater time. Part of that complexity here is that the issue was with WordPress.com the service, not WordPress the software.

5) I have seen many responsibly disclosed reports that are invalid. Responsible disclosure prevents these from escaping into the public. I'd question any shift to full disclosure by Ry Satterfield specifically because of this.

6) Full disclosure versus responsible disclosure for *software* is a whole different ballgame than what occurred here. It is a lot harder to justify full disclosure when we're not dealing with a software vendor but with a hosted service.