Hector Martin

Why? That’s a very typical process for academic submissions.

Typical does not make it right, and most (good) academic security papers aren't about software bugs but about deeper protocol/crypto breaks.

Not true. And typical, since it does not do any harm, makes it reasonable and not “irresponsible”.

It does harm - it adds 2+ months to the vulnerability window. At the very least you should be sending drafts of the paper out to vendors.

Finishing the paper, sending it in for review, *waiting 2 damn months* then casually starting to notify vendors is utterly ridiculous.

The two months do not add to nothing. You should try reading the ISO standards and some prior debate on disclosure.

You should try applying some logic. By your theory extra delay adds nothing, so we might as well never audit anything.

Nope, logic does not work that way, sorry.