I think it's a good idea when there is no CVE and a don't fix status.
Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.
I think it's a good idea when there is no CVE and a don't fix status.
Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.
If people can't be responsible, let's just create a mailing list, call it "full-disclosure" and post everything there.
For those following along at home: https://nmap.org/mailman/listinfo/fulldisclosure