OpenBSD followed the original embargo, and got asked to extend it based on the CERT response. You guys said no, and the security researcher shrugged and went 'Well, okay, I guess.' When everyone else is agreeing to the extended embargo, I personally can't say that I feel like OpenBSD respected the embargo there.
It's also not limited to just KRACK. With the OpenSSL/LibreSSL stuff back in 2015, OpenBSD wasn't part of the disclosure because Theo said he wasn't going to deal with an email-list or embargoes prior to that. Marc Espie has said he thinks it's a good thing that the KRACK embargo was broken early.
It's also not limited to just KRACK. With the OpenSSL/LibreSSL stuff back in 2015, OpenBSD wasn't part of the disclosure because Theo said he wasn't going to deal with an email-list or embargoes prior to that. Marc Espie has said he thinks it's a good thing that the KRACK embargo was broken early.