"First post" and it's relevant and useful. 3 hours old and -zero- noise. This is why I love HN.

You avoided commenting on the substance of their position, though. From your role as a security researcher, I suspect you're in the google camp. I'm close enough to a security researcher to agree, too -- but I also know my perspective is fairly clouded. How will the vendors respond?

I suspect Microsoft will be reasonable, although they'll pushback at the proposed default window of 60 days. Microsoft is in the singularly unique position of having a reasonably agile security team, matrixed across the product teams. The majority of other vendors (Adobe?) are still struggling to put even basic processes into place; they won't have a choice but to push back with vigor and fill the discussion with FUD.

I second your "congrats google" -- it is a clueful corporate move and inspires confidence in their corporate bureaucracy. But I'm skeptical on it's effectiveness.