<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 29, 2021, at 5:26 PM, Nick Hilliard <<a href="mailto:nick@foobar.org" class="">nick@foobar.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Because this didn't happen, we now get to look forward to a weekend of elevated risk, followed by people upending their calendars to handle un-coordinated upgrades on monday morning.</span></div></blockquote></div><div class=""><br class=""></div><div class="">That only happens if the team has the time to get the fix into the code, tested, validated, regressed, and deployed. I would say this is a classic example of “ego” to publish overruling established principles. </div><div class=""><br class=""></div><div class="">The University of Twente should explore requiring classes for responsible disclosure. </div><div class=""><br class=""></div><div class="">NCSC, it seems you threw out your own policy: </div><div class=""><br class=""></div><div class="">"The NCSC will try to resolve the security problem that you have reported in a system within 60 days. Once the problem has been resolved, we will decide in consultation whether and how details will be published.”</div><div class=""><br class=""></div><div class="">I would have expected you to council the researchers on responsible disclosure principles. </div></body></html>