Updated policy regarding exploits and 0days.

[comperr]

It is permitted to post FULL DISCLOSURE vulnerabilities provided the following have conditions been met:
1)You reported the issue to the developers in a reasonable manner.
2)It has been one week since you reported it and developers refuse to fix the vuln in a reasonable amount of time.
OR
the developers have not replied to you whatsoever
OR
the issue has been fixed and an update released
OR
The developers have allowed you to release the issue
old versions below
It is permitted to post FULL DISCLOSURE vulnerabilities provided the following have conditions been met:

1)You reported the issue to the developers in the manner in which they request.
2)It has been two weeks since you reported it and you have received NO reply.
OR
the issue has been fixed and an update released MORE THAN 3 days before the release of the vuln.
OR
The developers have allowed you to release the issue
OR
The developers have stated that they are REFUSING to fix the issue EVER (not that it will be done later or that they won't do it now).

[comperr]

old version
Another update:

If the developers state that the issue "will be fixed at some undetermined point in the future" and the company has a history of never fixing security issues (this is not Microsoft - they fix issues despite them having so many of them) then it is permitted to release a vuln in full.

[comperr]

Yet /another/ update.
This supersedes all previous polices and seeks to be more lenient.