> If you as a security researcher reasonably believe the vendor has neglected to patch the vulnerability, and you release exploit details, you are amplifying the current harm it's inflicting.

At least the public now has a fair chance to evaluate if they want to use their devices despite this vulnerabilities.

That's true, but it glibly ignores the reality of vendor lock-in. The average non-infosec human is not going to switch devices because of a vulnerability whitepaper. This "vuln-insensitive user" is better served by giving the vendor a longer timeline to take care of the issue, rather than releasing exploit details two weeks after someone changed a status on a ticket.

Then fight the lock-in, in court if necessary. Tort lawyer will have some fun with it if you can show you cannot evade losses of secure data.

I am pretty sure the line of defence will be weak "no warranty" claim that has nothing to do with lock in.

I feel that this rebuttle is silly. Nobody outside HN (and similar) will understand what this means. And, even if they do, many users cannot afford to buy an iPhone (the only real competition) just because of one security flaw that might affect them. Even then, the opportunity cost of switching is not minimal.

The fact that the only competition is unaffordable to a product with 85% global market share is a strong indicator we need to bust a monopoly for the public interest.

I wonder if Apple was perceived to be playing a security first product approach, whether this same audience would not be able to find a far more forgiving view of the Apple price list?

At the same time, it's a real "damned if you do, damned if you don't" situation, isn't it?

It is well documented that vulnerabilities are traded and sold freely online at various forums; since this isn't really a 0-day or an exploit as much as it is a new spin on a classic trick, there's no value in malicious actors hoarding the secret, especially since it's mostly a social engineering trick not an actual exploit.

In this particular case, the weight of the options seems to be "Make key users aware and put public pressure on vendors at the cost of giving a few bad actors an idea they didn't have before" versus "prevent giving a few more bad actors a new idea at the cost of Users being in the dark and vendors having no reason to address the issue"

The cost in this case seems pretty minimal, given that I'd assume there's no reason to really hang onto such a tactic.

For other exploits, it's basically the same idea: Who has the exploit, how likely is it that it's been sold, is the vendor likely to do anything about it, how dangerous is it to users? In most cases, if the exploit is already known and used among bad actors freely, what benefit is there to users in keeping such exploits hidden just to prevent a few more bad actors from doing it as well? Just seems like if the house is on fire, there's no sense in worrying about the wallpaper. (paraphrasing the quote since I can't remember its origin)

I don't really care what you believe about this stuff --- you're entitled to your opinions! --- as long as we're clear that people probably shouldn't be perpetuating the term "responsible disclosure".

And I don't really care what you call this stuff! "Coordinated disclosure" is a good value-neutral term and I appreciate the reasons why you prefer it. I'm just trying to get a discussion going on which approach, if any, is most responsible (lowercase).