Anyone who refuses to release vulnerability details 8 months after the fact, because they don't have "permission" from the authors of the dangerous application, should be considered black-hat. Their methods are, if anything, far more dangerous to the public than script kiddies grabbing fullz.