Hector Martin

That assumes you're the only one who knows about the bug so far. That is an irresponsible thing to assume.

In this day and age people buy and sell vulns and the NSAs of the world have an arsenal of 0days and holding onto bugs is just Wrong™.

You seem to assume this info may get in the hands of anybody, but the set of reviewers is public and the association between paper and reviewer is not lost after submission. If exploit leaks the one responsible can be singled out. That’s a significant control mechanism

I'm assuming someone may already know of this bug and be actively exploiting it. This is exactly the kind of ubiquitous bug govts love.

So you must be angry at the silent “early” update not at the disclosure to an “academic review board”.

I'm annoyed that disclosure to an academic review board (with zero benefit to security and low but nonzero risk of leak)...

Happened two months before disclosure to the first vendors (which is what actually helps security).

No. What helps security is the incentive to disclose. Bug bounties are that of sec res. Top confs are that of academics. With your rationale there would have been no disclosure (finding) at all. If you believe in discl for greater good go tell hackerone and co they’re pointless