I'll defend the researchers for trying to do a managed notification. But I wonder, did they try to reach out to the major OS vendors to see if they could get them any advance warning? Or ask OpenSSL if OpenSSL knew how to get in touch with people on the down-low?
Obviously they don't just send the exploit directly in mail to a mailing list. Email, ask to talk to someone over the phone, explain the situation to that person, ask for references on prior releases being well-handled.
I want to avoid Monday morning quarterbacking, though. In hindsight the right course of action is always obvious.
Wouldn't it have made most sense to e-mail the OpenSSL team so they could have pushed a critical patch that everyone would have updated to via APT before shit went off of the hook?
By being a major site that uses SSL. Many such users were notified ahead of time; it's nothing abnormal with responsibly disclosed bugs. As far as I'm aware, no money changed hands whatsoever.
