Hector Martin

Typical does not make it right, and most (good) academic security papers aren't about software bugs but about deeper protocol/crypto breaks.

Not true. And typical, since it does not do any harm, makes it reasonable and not “irresponsible”.

It does harm - it adds 2+ months to the vulnerability window. At the very least you should be sending drafts of the paper out to vendors.

Nope, it doesn’t. Academic review of these papers happens under secrecy (this was NOT leaked in the academic review process).

That assumes you're the only one who knows about the bug so far. That is an irresponsible thing to assume.

In this day and age people buy and sell vulns and the NSAs of the world have an arsenal of 0days and holding onto bugs is just Wrong™.

You seem to assume this info may get in the hands of anybody, but the set of reviewers is public and the association between paper and reviewer is not lost after submission. If exploit leaks the one responsible can be singled out. That’s a significant control mechanism

I'm assuming someone may already know of this bug and be actively exploiting it. This is exactly the kind of ubiquitous bug govts love.