pull down to refresh
reply
Right. A vague statement like this makes sense to me because it communicates to people that there’s a reasonable possibility that something’s wrong with their setup without putting them at risk by pointing attacks towards them.
reply
Exactly, though before the "responsible disclosure" process meant you completely stfu in public until it is patched. I do think that there is no point anymore. Even Linux kernel security people are arguing that it's better to say what's wrong straight away (and offer a mitigation) than to have an embargo.
Not everything will have a mitigation though.
reply
How should he do this? Just try to privately contact the developers.