I'm not a security researcher, so I'd like to know if (probably "why") this is a bad idea:
It seems like there should be some intermediary stage between logging the vulnerability & full public disclosure. Something like a partial public disclosure that says "Hey, we have a CVSS 10 about to come down on Log4j, everyone carve out a chunk of time to get their systems fixed when we publish to full disclosure & patch."
And security & sysadmins around the world can get ready to work before exploits can get too much of a hold.
It seems like there should be some intermediary stage between logging the vulnerability & full public disclosure. Something like a partial public disclosure that says "Hey, we have a CVSS 10 about to come down on Log4j, everyone carve out a chunk of time to get their systems fixed when we publish to full disclosure & patch."
And security & sysadmins around the world can get ready to work before exploits can get too much of a hold.