CERT has been ISC's partner in the discovery and publication of critical bugs in BIND and other software ever since ISC was founded, and ISC anticipates continuing this relationship in the foreseeable future. If they decide that the bind-members Forum is an acceptable notification method then they may choose to depend on it for their own vendor notices concerning BIND bugs. In any case, ISC will notify CERT of any critical bugs we discover before bind-members hears about them. It's been said that CERT is too conservative about bug notifications, and that by the time they publish their vulnerability notices, everybody pretty much already knows what's going to be in it. The bind-members Forum was created to formalize and facilitate that contact.
Every participant has to weigh that for themselves.
It is expected that the period between the discovery and publication of a critical bug will be limited by practicality to a short few days, and that a prospective participant would see it as being in their customers' best interests to cooperate with such a delay. They will also agree to avoid general internal discussion of things they learn from the Forum. By definition, undetected NDA violations are of no concern to anybody. If ISC detects a violation, then we reserve the right to terminate the violator's participation in the bind-members Forum. No, you can run a single server if you want.