The other comment has a link with a good overview of the fight, but there's a tiny but of nuance to why this is especially "bad." Essentially they are announci

The other comment has a link with a good overview of the fight, but there's a tiny but of nuance to why this is especially "bad." Essentially they are announcing a CVE on software while holding the fix for it hostage to normal users.