I'm following this for the most part, but what I don't understand is why they thought they needed to stand up an entire domain name and website and coordination point, and then ... do almost nothing with it [initially, and for a couple days after].
Either they thought it was important enough to do that, and they therefore have a corresponding obligation to at least minimally coordinate and inform defenders (which is what many named vulnerabilities have done in the past), or ... it wasn't. They've chosen some weird middle ground, and even if it was only for marketing reasons, it sure doesn't make me want to buy their product, because I don't trust them to have the judgment or good taste to understand the implications of what they're choosing to do.
