Non-disclosure, vs. Responsible disclosure, vs. Full disclosure (with various levels of warning to the vendor), vs. Aggressive full disclosure is certainly an open point of debate within the security industry. It's pretty unambiguously clear that he didn't use the fruits of the vulnerability in a black hat way to hurt the end users, however.

My personal position varies based on the kind of vulnerability, actual risk to end users, etc. For something which causes minimal harm to the end users (publishing email addresses? really?), which was the result of utter incompetence on the part of a single vendor, and where the vendor can trivially fix it, I think aggressive full disclosure is the right course of action.

If it were something like a flaw in cisco bgp, I would support responsible disclosure, on a very long timescale; give the vendor enough time to fix it, and get the patch deployed to as many users as possible.

If it were a flaw in a no-longer-maintained system which were critical to life safety, I could be convinced to not disclose at all, provided there were something put in place to transition users off of the system.