Should this have been done as a private disclosure to browser vendors first before going public, or is that more for security problems?