Maybe a logical "2nd step" for you would be to disclose that you've found a substantial bug that could "financially harm users" if exploited...but don't actually share the exploit. Post that you've contacted the developers as of <date> and will give them X-days to resolve the issue.
Now, as for that final step...that's up to you. Not sure the legal ramifications for sharing the exploit, or frankly, what the benefit to the community would be. I think your goal should be to put pressure on the developers, but not to actually expose the threat. If they never get around to fixing it, you've just potentially screwed the community (not to mention those that might never see the update).
I don't actually schedule anything, but I've got a number of things to juggle. Thankfully, I've got a wife who runs her own business and understands the rigors of being a bootstrapped startup-er.
That said, I'm more goal-oriented than calendar-oriented. I try to set weekly goals, and chunk them down into daily goals. Each day, I'll set one must-do goal per "thing" that I'm involved in (startup, consulting, family, life). If I manage to get other stuff squeezed in, that's a bonus.
This way I don't restrict myself to only spending time with family between 6-8pm...I do it whenever I want and get the rest done when appropriate. Obviously some items (consulting) may require more strict calendaring, but you can flex around that.
For me, a hard time-based schedule is not going to make me more productive...it has the opposite effect on me. So, I'm lucky enough that I can work things in a way that work for me best.
These are all great points, Joel. Being in the middle of this myself, every title and summary I skimmed through are 100% vital to getting your startup off the ground. Nice consolidation!
Interesting question, one that'll likely be debated forever.
Regarding this - I see most people falling into one of two camps: (1) Trusting of people from the onset and slowly build walls due to bad circumstances, or (2) Walls pre-built and people need to break them down in order to "get in".
#1 will likely share their ideas freely
#2 will likely not
(there are always exeptions...)
What camp do you lean towards? My recommendation is that you try a little of the opposite... In my opinion, this is based around a fairly core trait...trust. You are who you are, and it's not easy to change a core trait like that. However, you can shift a bit and not make yourself uncomfortable.
It's probably been said a billion times, but ideas are nothing...action is everything. If you're not taking action yourself, and you need others to help...keeping that idea to yourself isn't going to get you any further.
That's really the bottom line.
Find the right people you can trust and talk to them. At some point, you do have to open up and share.
By the way, guilty as charged in the past. I've shifted, and am much happier for it.
I agree about the lawyer comment. At minimum, get an opinion. Secondarily, you can also negotiate to pay only based on success. So, you don't pay unless you win. It's a fairly common practice, expecially if you've got a good case.
Now, as for that final step...that's up to you. Not sure the legal ramifications for sharing the exploit, or frankly, what the benefit to the community would be. I think your goal should be to put pressure on the developers, but not to actually expose the threat. If they never get around to fixing it, you've just potentially screwed the community (not to mention those that might never see the update).