ISC found that speaking to vendors through the CERT advisory process was somewhat awkward and made for extra work on both sides, ... The next time we learn, through CERT or otherwise, that there is an attackable bug in code that we've published, we hope to have a direct and very private communications forum with the people who run the Internet infrastructure or who need lead time to prepare patches for their customers.
The internet has no government, no constitution, no laws, no rights, no police, no courts. Don't talk about fairness or innocence, and don't talk about what should be done. Instead, talk about what is being done and what will be done by the amorphous unreachable indefinable blob called the internet user base.