The point of calling it "responsible" has nothing to do with defending researchers; it's literally the opposite. The norms of "responsible" disclosure were absolutely not the norms of vulnerability reearchers of the time. The term was invented back in the early aughts by @stake, then the largest software security consultancy in the world (my company, Matasano, was essentially a spin-off of @stake; one of my cofounders was an @stake cofounder).
This is one of those things, like "Zero Trust Networking", where people read the term, (reasonably) believe they understand what the words mean, and then axiomatically derive the concept. But, no, the concept has its own history and its own meaning; the words have little to do with it (except that here, it's especially obvious what's problematic about the words themselves).
The industry has largely moved away from "Responsible" disclosure to "Coordinated" disclosure, for all the reasons I've given here. Even CERT, the most conservative organization in software security, uses the new term now.
Later edit
This originally read The norms of "responsible" disclosure were absolutely not the norms of "Responsible Disclosure", which was a typo.
Yes, CERT has moved using CVD, but I argue that's because of their conservationism. They don't want to rock the boat and tend towards vendor friendly, neutral language. That makes sense for their niche.
And just throwing it out there that the older term that's actively being erased because its implications are unfriendly to entrenched interests isn't the "Orwellian" one.
Here's the 2002 I-D that Weld worked on with Steve Christey standardizing the term. It's notable for being roughly contemporaneous with @stake firing Dan Geer over, as I recall, somehow alienating Microsoft, one of @stake's larger clients.
https://cve.mitre.org/data/board/archives/2002-02/msg00026.h...
Your link, for what it's worth, doesn't use the term at all. But even if it had, it wouldn't change anything.
Just to keep this on track: your claim was that "Coordinated Disclosure" --- the near-universal standard term for what used to be called "Responsible Disclosure" --- is an "Orwellian re-imagining". Leaving aside the fact that there's nothing intrinsically "Orwellian" about renaming something, the fact remains: "Responsible Disclosure" was researcher-hostile and patronizing, and has been chucked out the window by almost everybody who matters in vulnerability research.
We've managed to hash out a hot topic from, like, 2012 on this thread, which is great, it's progress, we move forward bit by bit here on HN, just like Joel Spolsky once said; "fire and motion". But we can probably be done now.
Lots of people with better reputations than Bright have publicly lobbied against disclosure of any sort. Bruce Schneier is a great example of this; if you're an old industry head, Marcus Ranum is another name here. The point isn't that everybody agrees with me about "Responsible Disclosure"; it's that everybody who matters does.
And project zero puts an emphasis on disclosure, not coordination. When the ticker runs out they nearly always disclose, regardless of where coordination is at. That's what Peter Bright was ultimately complaining about; they disclosed like a week before one of the relevant patch tuesdays.
Like I've said, the primary point isn't the coordination. That's the carrot to get the vendors to play game on a sane schedule because otherwise the vendor holds all the cards.
I mean, that half is the carrot to get vendors to play ball and actually fix their shitty code occasionally. It lets unaffiliated white hat security researchers who are just trying to get sec issues fixed actually get some focus time from the various sauron-esque eyes that are corporate attention by converting a 'bug report' into an 'impending pr nightmare bomb with a known timer'. It's a similar hack to complaining on twitter to deal with a marketing department instead of calling in to a customer service line that's just trying to get you to go away.
> It has pissed researchers off for decades, as it implies that not following the "responsible" process makes one per se "irresponsible".
The point of calling it responsible is to defend the researchers who have massively less power in the relationship against the vendors. Even now you'll see whitehats lambasted for eventually disclosing after a vendor dragged their ass. Beyond that, yeah you can't please everyone.