It seems like you don't agree with coordinated releases as a standard. That's fine, but irrelevant here. If you agree to coordinate, so that you can get inside info on security updates and be prepared, and then break that agreement, you're not trustworthy. No hand wavy reasons will change this fact.
I don't know many who want to deal with untrustworthy people.
what exactly is the point of maintaining coordinated disclosure even if one believes in it wholeheartedly in the case where the thing in question is under active exploitation already and there is no longer any hope of quietly solving the issue before active exploitation begins?
are we to somehow count the hypothetical future exploitees that may yet be helped by avoiding disclosure 1–1 against the actual literal current exploitees harmed by further postponing the fixes landing?
The question is where do you spend your trust. If you think that you'll always be able to find and patch 0-days before anyone else into the indefinite future then it's fine to defect.
If you want your customers to believe they won't be hung out to dry when the broader community patches before they can because you're no longer in the loop, you cooperate.
It's not like this is the last 0-day that will need to get patched and deployed in a hurry. "Not slower to patch than
virtually anyone else" is a pretty sustainable place to be.
It seems like you don't agree with coordinated releases as a standard. That's fine, but irrelevant here. If you agree to coordinate, so that you can get inside info on security updates and be prepared, and then break that agreement, you're not trustworthy. No hand wavy reasons will change this fact.
I don't know many who want to deal with untrustworthy people.
what exactly is the point of maintaining coordinated disclosure even if one believes in it wholeheartedly in the case where the thing in question is under active exploitation already and there is no longer any hope of quietly solving the issue before active exploitation begins?
are we to somehow count the hypothetical future exploitees that may yet be helped by avoiding disclosure 1–1 against the actual literal current exploitees harmed by further postponing the fixes landing?
The question is where do you spend your trust. If you think that you'll always be able to find and patch 0-days before anyone else into the indefinite future then it's fine to defect.
If you want your customers to believe they won't be hung out to dry when the broader community patches before they can because you're no longer in the loop, you cooperate.
It's not like this is the last 0-day that will need to get patched and deployed in a hurry. "Not slower to patch than virtually anyone else" is a pretty sustainable place to be.