Not to disagree, but which vendors? SSL is an open standard used by a wide variety of applications, not just web browsers. There are vpn's that rely on it for example. Should the person who found the flaw have limited notification to a few companies that write web browsers, or should he have made an effort to hunt down each and every product that embeds SSL or links to the libraries to make sure that they know?The details in the article are a bit light in that it states that the person who found the flaw after the initial developers were working on resolving it 'posted details' without any indication of whether the 'details' included a theoretical explanation of how to make use of the flaw, beyond later stating that there are not any exploits known yet.It also sounds like he wanted to work on fixing the problem rather than exploiting it, or encouraging others to exploit the flaw.