There's the KRACK vulnerability issue [1] where OpenBSD pushed a minor patch and published information on the originally agreed embargo date, which was extended

There's the KRACK vulnerability issue [1] where OpenBSD pushed a minor patch and published information on the originally agreed embargo date, which was extended. OpenBSD made sure to not mention the attack and instead say that it was fixing an OpenBSD-specific issue, and others agreed that it didn't constitute a violation of the embargo agreement. However, given Theo de Raadt's colorful past, OpenBSD's relatively small userbase, and this relatively minor incident, I can see how other companies may think that it's not worth the risk of including OpenBSD in an embargo. It's not fair, but it is what it is. [1] https://marc.info/?l=openbsd-tech&m=152910536208954 https://marc.info/?l=openbsd-tech&m=152910536208954