When the developer doesn't care to fix it, is it better to know a vulnerability exists, or to be in the dark and let someone else find it? Take a look yourself: this was posted in April 2009, and an update didn't happen until 25 October. Apparently there was at least one other person that reported this before I published this as well.