Screaming Penguin - Source Does Matter

Well I guess I dont have the answers to everyones issues, but I would say publish it as soon as you know about it, patch ready or not. Thats the way open source security works, thats what makes it work (IMHO).

For example, what if someone else had discovered the flaw on December 10th, someone less reputable than ISS? If the warning had come out as soon as it was known about then sendmail could have been disabled, or conifigured differently or whatever to avoid the exploit.

I know this is a hotly debated topic by my vote is publish it when we know it exists, patch or not, no matter who you are.

And again I am not faulting ISS, I think the way they handled the previous Apache issue was correct and I think that on this one the Homeland Security Department got involved and that probably accounts for the delay (and several million of our tax dollars, for the same functions that ISS was doing fine on its own before, ISS and others, CERT, etc).