Hector Martin

No. It's not fair to demand free labour from people *AND* demand they do it exactly how you would like. Why didn't you find the bug?

This isn't about free labour, it's about basic security research etiquette. Sitting on bugs is considered evil.

I sit on bugs. Because no matter how I disclose them, how much work I put in, however I do it, someone like you will call me an asshole.

And I have every right to consider you an asshole to doing that :-) Have you considered anti-user systems? Sitting on those bugs is fine :P

Here's the thing: I enjoy reading source code. I notice bugs. How is not disclosing functionally worse than not reading in the first place?

It isn't. You're demanding extra work from me or I'm "evil". Nonsense. Don't like it? Pay me, or do it yourself.

He wrote the paper then randomly waited two months. He already did the work. He could've sent the draft to CERT. He chose not to.

And calling him an evil asshole will have what effect on his next disclosure? A) he does it like you want B) he doesn't do it at all