Hector Martin

Is anyone else annoyed that the WPA2 KRACK paper author sat on it for >2mos before any disclosure and 5mos before public disclosure?

No. It's not fair to demand free labour from people *AND* demand they do it exactly how you would like. Why didn't you find the bug?

This isn't about free labour, it's about basic security research etiquette. Sitting on bugs is considered evil.

I sit on bugs. Because no matter how I disclose them, how much work I put in, however I do it, someone like you will call me an asshole.

And I have every right to consider you an asshole to doing that :-) Have you considered anti-user systems? Sitting on those bugs is fine :P

Here's the thing: I enjoy reading source code. I notice bugs. How is not disclosing functionally worse than not reading in the first place?

It isn't. You're demanding extra work from me or I'm "evil". Nonsense. Don't like it? Pay me, or do it yourself.