I'm not against people patching things themselves. But my grandmother can't apply patched source code to the firmware for her Belkin cable modem. And I sure as hell can't patch the firmware for my carrier's locked Android phone. My Smart TV is probably just fucked. If these vendors were contacted before release, they may be able to keep people safe at publishing time.

What you seem to be suggesting is that we should simply all disconnect from the internet until vendor patches can be prepared, the reason being it's better to stop any potential and unknown exploits going on now, than stop the hundred-fold new exploits that absolutely will follow its public announcement.

> If these vendors were contacted before release, they may be able to keep people safe at publishing time.

You mean if hundreds of the popular vendors were notified for a coordinated release? And you think that's not making the exploit effectively public? Even skipping possible monitoring of emails, I don't expect that the set of blackhats and employed security engineers have no common elements.

Good point. Does that mean there should be zero coordination? What about coordinating with the security teams for a few big Linux distributions? That would be a much smaller list of people, and might make it easier/quicker for some commercial vendors to get fixed once the public announcement is made.

The problem is that we don't have any laws forcing vendors to keep their products (smartphones, TVs, embedded (networking) devices up to date. It's high time to change that.