Comment by lolinder

Does anyone have context for why "best practice" would be to disclose before there's a fix available? This is news to me (most of the time I see CVEs it's right after a patch), and it seems backwards—if there's nothing that customers can do about it yet then what good is releasing the details of the vulnerability?