alt Hacker NewsI think something has gone very wrong for you to be doubting the answer.
Responsible disclosure is to prevent harm. You think about your disclosure options and pick the one that is best overall weighing the impact and harm.
They're already infected - or so you claim.
I get that companies want to use responsible disclosure as a mechanism so it can save face and their reputation, and if both are possible at the same time then sure.
But if you think you're right, you have to pick one and live with the consequences; and its not that hard to pick the right choice.
In fact, if you don't make the right choice you need stop misusing the word “responsible disclosure”.
Publish the URLs that prove they're infected. Auto update it whenever one get's fixed.
Replies
This seems correct? If true, they are currently dangerous to others and they should be called out for it. Why will people be more proactive here if they can just hide their mistakes?
> companies want to use responsible disclosure as a mechanism so it can save face and their reputation
That sounds like the opposite of the goal of that procedure, since the point is the disclosure. Telling everyone about a weakness before it can be solved would harm users, that's why you coordinate with the vendor, but disclosure and resolution is the goal you're working towards. Saving face would be a gag order or agreement, which many companies indeed have tried, but that's the opposite of companies that publish their procedure for coordinated vulnerability disclosure (also/formerly called responsible disclosure) so that white-hats can report issues without fearing legal action. That also means that these companies have to own up to it once the issue is resolved, or at least the hacker is free to talk about it
The rest of your comment is right though: for sites that are already infected, being quiet about it doesn't prevent a vulnerability from being exploited anymore