Hector Martin

Heck, the paper would be *improved* by including relevant discussion about vendor responses and fix approaches and indeed many do so.

Imo don't complain someone is taking fame and reputation as reward for their work unless you're offering some other form of currency

Yes it's selfish and self-serving. So what? So is charging for the software I make instead of making it freeware.

There is a significant moral difference between withholding access to software and withholding vuln info, esp. for something this widespread

Why? Withholding vuln info is no different practically to not discovering the vuln at all. And you can't compel people to discover!

It's an effort/reward issue. Disclosing early doesn't cost you anything extra but helps everyone. What was the point of it?

You can't compel people to discover but you can damn well ask them to be reasonable once they do.

Discovery takes lots of effort. Disclosure takes some effort. Timely disclosure when you're already writing a paper takes negligible effort.