To me it seems mostly a difference in principles. If OpenSSL and others work with embargoes and LibreSSL/OpenBSD doesn't accept them, there is no solution that

To me it seems mostly a difference in principles. If OpenSSL and others work with embargoes and LibreSSL/OpenBSD doesn't accept them, there is no solution that satisfies both sides. Indeed, this is the main point, OpenBSD developers are proponents of full-disclosure: http://www.openbsd.org/security.html http://www.openbsd.org/security.html This paragraph summarizes it very well: Security information moves very fast in cracker circles. On the other hand, our experience is that coding and releasing of proper security fixes typically requires about an hour of work -- very fast fix turnaround is possible. Thus we think that full disclosure helps the people who really care about security.