Hector Martin

I sit on bugs. Because no matter how I disclose them, how much work I put in, however I do it, someone like you will call me an asshole.

And I have every right to consider you an asshole to doing that :-) Have you considered anti-user systems? Sitting on those bugs is fine :P

Here's the thing: I enjoy reading source code. I notice bugs. How is not disclosing functionally worse than not reading in the first place?

It isn't. You're demanding extra work from me or I'm "evil". Nonsense. Don't like it? Pay me, or do it yourself.

He wrote the paper then randomly waited two months. He already did the work. He could've sent the draft to CERT. He chose not to.

And calling him an evil asshole will have what effect on his next disclosure? A) he does it like you want B) he doesn't do it at all

He already decided to break disclosure protocol with OpenBSD in the future to avoid being called out, so he's clearly a lost cause.

Dude just found a pretty neat bug that no-one else had disclosed if you think he has nothing to offer you need to slow the fuck down