> A mechanism requiring disclosure of how long security updates are available seems like a great step.

So, as I work in this space, there needs to be realistic guidelines on this, does a security flaw need to have a CVE ? Do they need to fix every CVE ? What is the timeframe requirement ?

This kind of thing keeps me up at night.