Zach Stein-Perlman comments on How are voluntary commitments on vulnerability reporting going?