Hector Martin

Except there had been a patch for months already.

That seems on the EFF. But I saw some threads from 5/14 re: Enigmail saying that some modes were still vulnerable. So I’m a bit skeptical about this.

No, mostly it's on the researchers, who seemed to be completely lost as to what was being mitigated when and where, and who were entirely responsible for feeding the info to the EFF as far as I can tell (and on the EFF for buying it).

If you're coordinating disclosure, you're supposed to *understand* the interactions between different bits of software, and encourage cross-vendor collaboration to make the impact known and figure out how mitigations are deployed and interact. The researchers totally botched this

The fact that *I* needed to go around asking some people for info and digging for commits and bugs and mailing list threads to figure out how the fuck this all works and that nobody else did so tells me this disclosure was a massive clusterfuck, and that's on the researchers.

The researchers notified every single relevant project. What precisely are you asking them to do differently? They gave months of notice on a handful of bugs with a SIMPLE PATCH.