pull down to refresh
Yeah, this is the part I hadn't really considered when writing it.
Announcing that something is wrong before operators actually have the binary changes the threat model by itself. You've basically told everyone where to start looking while defenders still have nothing to deploy.
So the 14-day embargo may not even be the most interesting part here. The timing of the announcement vs the availability of the fix might be.
Definitely something I'll revisit once the source drops. Thanks for adding this.
Oh embargo means you're for a limited time not disclosing what you're patching because it is sensitive.
What this rule means practically is: complete radio silence before you have your release ready for download. Work on a patch in silence. Release it. Do your announcement within minutes of publishing the release and as wide as possible - whatever your message is. Don't leak at any point that you're working on something, not even to the reporter.