tptacek is just trying to speak from a position of authority, there is no substance to his argument. The position is that it’s a term used by vendors... therefore bad? I’ve already pointed out there is an entire academic subfield to infosec that uses the term that has no financial incentive like a vendor.
Releasing anything that can be used to harm the public has ethical implications, period. There is no grey area there. Responsible disclosure is entirely about minimizing impact.
People that don’t like the term don’t like it because they don’t like the idea that there are ethical implications for releasing information.
Do you think there is an ethical gray area to releasing a method to the public to gain access to the secure side of an airport terminal without going through security so guns/bombs can be brought in undetected? What if that method is a software vulnerability in the door locks they use?
> The better term is "coordinated disclosure". But uncoordinated disclosure is not intrinsically irresponsible. For instance: if you know there's an exploit in the wild for something, perhaps go ahead and tweet the vulnerability without notice!
FFS, that’s why the term is “responsible disclosure” and not “coordinated disclosure”. Responsible disclosure is the entire process of determining when and how to inform vendors and/or major users or if to inform them at all. Responsible disclosure is entirely about doing disclosure in the least harming way possible to the public.