What an embarrassment. Blumenthal should leave the performative infosec policymaking to his colleague Ron Wyden.<p>It is not and never has been a norm for SAAS vendors to disclose internal vulnerabilities that have not been discovered independently by third parties. Tens of thousands are found every year by internal teams and contractors at companies around the country, many of them far more severe than the G+ bug (which would probably win a sev:low on a real assessment, less impactful than an XSS bug). You hear about none of them.<p>A coherent argument that this is as it should be: <a href="http://flaked.sockpuppet.org/2018/10/09/internal-disclosure-boring.html" rel="nofollow">http://flaked.sockpuppet.org/2018/10/09/internal-disclosure-...</a><p>You can argue that things should be different for shrink-wrap software and hardware products, where vulnerabilities have a half-life and users need to be notified to patch. I won't disagree, but I will note that the norm of <i>not</i> disclosing internal discoveries holds there as well.