Comment by nahsra

Just FYI, "responsible disclosure" is a term that many people (like me) dislike because it carries judgment about the merits of public disclosure that are not at all obvious.

This term came from an era where companies or projects were disrespectful and dismissive towards security researchers. Those orgs were generally bad risk practitioners, and they coined the term "responsible disclosure" to mean "you send us the info and we'll do whatever we want with it, for however long we want, etc".

Many security people (like me) prefer the term "coordinated disclosure" as a way to indicate a practice where both discoverer and patcher participate in a good faith, communicative, and timely process to get things fixed for the community.

The difference can be summed up like this: if I report vulnerability X to company Y, and company Y sits on it for 3 years, that is not responsible. It is more "responsible" (especially today) to report it to the public, so they can protect themselves in a non-official-patch way, because the likelihood of bad guys knowing about it and exploiting it are approaching near-certainty.

These terms are obviously not super scientific, but I try to point out the history whenever it comes up.