Juraj (nprofile…4sav) my guess was that it would buy them a day, that might have been too optimistic.
It's nice to have a short window for a trusted binary update. It's not my thing, even though it's not like I actually check the source when rebuilding. But it might be acceptable for some.
Two week embargo is clearly too ling now. It's potentially a matter of hours now, plus whatever time the actual attack takes to set up and execute.
So you might as well just do a regular open source update and only tell your friends that it's urgent. Not a great option either.
