Comment by Dylan16807

Let me try to split these concerns up:

1. The time it took to develop the patch doesn't matter. Nobody leaked anything during that period. It just needed to not be a huge length of time.

2. The time between the warning and the patch release is overall a good thing. In this case the secrecy failed halfway through and we only got a fraction of the benefit, but it was still better than "surprise and good luck with the imminent exploits, hope you weren't asleep!". If the secrecy hadn't failed it would have been much better.

3. There needs to be an official patch before releasing the details. Some random untrusted person publishing a patch has all the downsides of releasing the exploit but people can't safely install it fast.