[B Knotts]

That has to do with CERT, who have a policy since last year of notifying vendors/distributors first, before publicly announcing a vulnerability.

And at the time CERT adopted this policy, some people predicted problems like this as a result (i.e., waiting to fix bugs until right before the public announcement).

[danneskjold]

That has to do with CERT, who have a policy since last year of notifying vendors/distributors first, before publicly announcing a vulnerability.

What exactly is the point of that policy?