Renaming "responsible disclosure" to "coordinated disclosure" seems to have the same flaw, since a lazy company involved in coordinated disclosure might look more committed than it really is. The focus should be in the process and not the names.
Renaming "responsible disclosure" to "coordinated disclosure" seems to have the same flaw, since a lazy company involved in coordinated disclosure might look more committed than it really is. The focus should be in the process and not the names.
Responsible disclosure puts the responsibility onto the researcher - it implies they're irresponsible if they didn't comply with the company's timeframe.
Coordinated disclosure accurately describes what _should_ happen - the disclosure happens after some X time (where X is a reasonable time that depends on the vulnerability, as determined by the researcher).
It's still completely responsible and ethical of a researcher to disclose an unpatched vulnerability even if the company/project doesn't want to, if they've unreasonably delayed patching. They'd never do it otherwise, and the public deserves to know those internal practices.
I feel this is a similar argument as the one about capitalizing "Internet", though.