If you were a software vendor, would you be OK with a researcher releasing details about a particular bug in your product if you didn't patch within a set time?