How to disclose a security vulnerability in an ethical fashion?

You should let the developer(s) know privately so that they have a chance to fix it. After that, if and when you go public with the vulnerability, you should allow the developer enough time to fix the problem and whoever is exposed to it enough time to upgrade their systems. Personally, I would allow the developer to make the announcement in a security bulletin in most cases rather than announcing it myself. At the very least, I would wait for confirmation that the vulnerability has been fixed. If you have time and have access to the source code, you could also provide a patch.

Personally I think Responsible disclosure seems to be the best way to go from an ethical point and worked well for Dan Kaminsky revealing the details of the DNS cache poisoning vulnerability. But it all depends greatly on the company or group you are dealing with and also the user base that it will affect.

@VirtuosiMedia does a great job of outlining "Responsible Disclosure".

I would add two points:

• Work with the vendor (if you can), to ensure they understand it fully and don't issue a half-baked patch.
• If the vendor disregards you or ignores you, keep trying. However, if they claim it's not a vulnerability, go ahead and publish. As loud as possible. If they promised to fix, but don't, try to get an answer from them, together with a definitive timeline to which they commit. At some point, if they keep postponing, eventually you might want to tell them you're going to publish anyway - and then give them some time to actually fix it (but short and limited.)