Hacker News Reader

How long have you given them so far?

I have been sending emails asking for a place to disclose the issue since January.

Google gives vendors 60 days IIRC. Pick a list and publish: http://seclists.org/

Much appreciated I had not thought of this route and you saved me a google search.