It's not like this was someone revealing the vulnerability, though. The first knowledge of it was an in-the-wild attack; not much you can do about it at that point.

This has been going on for days (months, if it is the same thing as the November/December problems), so I assumed Yahoo knew about it.

I only care because my dentist's receptionist uses Yahoo.