I'm personally kind of surprised about the amount of people that are against discussing vulnerability details.
Firstly, hiding information -- especially about security vulnerabilities -- doesn't help anyone. There should be a free and open discussion so that not only can people learn what not to do in their own code base, but it allows people to reasonably test their systems for the vulnerability that has apparently been patched and similar vulnerabilities with their new set of working knowledge.
Secondly, while there is a good case for not providing a free, copy and paste exploit on SSE the fact of the matter is that it is not up to the community to prevent such solutions from being passed around. It's Sitecore's, the actual company, job to disclose vulnerabilities of this magnitude to its major partners and vendors in a quiet fashion first -- but this window needs to be incredibly small. They shouldn't give them weeks or months.
Once the vulnerability is publicly released and people with a decent enough skill can decompile the updated binaries, there is no point in silencing discussion around it. It's already public. It's pretty unlikely that anyone with the means and skills to carry out something nefarious is going to care about who is discussing it, nor will they need people to point them in the right direction. It's my belief that by taking such a stance, we're really harming the community as a whole.
I think Bruce Schneier sums this up in a very succinct fashion:
What we've learned during the past eight or so years is that full disclosure helps much more than it hurts.
[...]
This democratization is important. If a known vulnerability exists and you don't know about it, then you're making security decisions with substandard data. Word will eventually get out -- the Window of Exposure will grow -- but you have no control, or knowledge, of when or how. All you can do is hope that the bad guys don't find out before the good guys fix the problem. Full disclosure means that everyone gets the information at the same time, and everyone can act on it.
And detailed information is required. If a researcher just publishes vague statements about the vulnerability, then the vendor can claim that it's not real. If the researcher publishes scientific details without example code, then the vendor can claim that it's just theoretical. The only way to make vendors sit up and take notice is to publish details: both in human- and computer-readable form. (Microsoft is guilty of both of these practices, using their PR machine to deny and belittle vulnerabilities until they are demonstrated with actual code.) And demonstration code is the only way to verify that a vendor's vulnerability patch actually patched the vulnerability.
[...]
Full disclosure is essential if we are to continue to improve the security of our computers and networks.
From: https://www.schneier.com/crypto-gram/archives/2001/1115.html
I think Responsible Disclosure is reasonable, given limited windows. Responsible Disclosure is something that needs to happen between Sitecore and its sizable partners. However, the moment Sitecore publicly released the patch the timeline for Responsible Disclosure ended. The information is public. Hiding discussion about the issue hasn't historically mitigated exploits when the vulnerability is known and can easily be reconstructed from the publicly available patch.
By giving people all the necessary information about the vulnerability, including code, we give them the ability to not only understand the issue, but verify the patch works on their system, look for any similar exploits that exist either within Sitecore or the implementation, and also hopefully prevent anyone from making similar mistakes in the future.
Full Disclosure increases community knowledge and safety. Responsible Disclosure can do this in a reasonable way while alleviating certain fears about potential attacks. But Responsible Disclosure only works when the exploit is not public. The exploit is now public. We cannot reverse Sitecore's public announcement and we surely can't pretend that this is the only place people will discuss this issue in its various forms. So what does the community truly gain by preventing discussion and disclosure around the vulnerability on SSE?
